CVE-2024-3659

10.0 criticalEPSS 1.6%

Critical (10.0) in kaongroup ar2140 firmware. EPSS 1.6% chance of exploitation in the next 30 days.

Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router.

Severity

CVSS 4.0

10.0 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2024-08-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kaongroup:ar2140_firmware

References

https://cert.pl/en/posts/2024/08/CVE-2024-3659
https://cert.pl/posts/2024/08/CVE-2024-3659

Check your stack JSON