https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:18:25 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52749 <p>The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.</p> <p>This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.</p> <p>The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.</p> <p>This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52749 https://vulnerability.circl.lu/vuln/ghsa-rmcq-5353-m59x <p>The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.</p> <p>This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.</p> <p>The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.</p> <p>This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.</p> https://vulnerability.circl.lu/vuln/ghsa-rmcq-5353-m59x