---
id: CVE-2026-52749
title: "The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests.\_This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an auth…"
summary: "The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests.\_This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an auth…"
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-287
vendor: Kaon
product: AR2140
affected:
  - AR2140 <= 4.2.17
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T13:17:22.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52749'
references:
  - url: 'https://cert.pl/en/posts/2026/09/CVE-2026-52748'
    label: cvd@cert.pl
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-28T13:19:12.756407Z'
cvssSource: cna
ingestedAt: '2026-09-28T13:09:42.228Z'
---

## Overview

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.

This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.