CVE-2024-3659

Command injection in KAON AR2140 routers

State: Published
Severity: 10.0 Critical
Published: Aug 8, 2024
Updated: Nov 17, 2025
Reserved: Apr 11, 2024

Description

Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	CERT-PL
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
AR2140KAON Group	3.0.0 to before 3.2.50Affected 4.0.0 to before 4.2.16Affected

References

https://cert.pl/en/posts/2024/08/CVE-2024-3659third-party-advisory
https://cert.pl/posts/2024/08/CVE-2024-3659third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.