CVE-2024-3659 is a high severity shell command injection (CVSS 7.2) in the firmware of KAON AR2140 routers. A crafted request to one of the endpoints runs shell commands, and the attacker needs access to the administrative portal. CERT Polska reports the patch in 4.2.16. The record and CERT Polska differ on affected ranges.
Weakness class: CWE-78, CWE-77.
What's affected
- Product: KAON Group AR2140 router firmware.
- Record: affected prior to versions 3.2.50 and 4.2.16.
- CERT Polska: affected from 3.2.46 up to before 4.2.16, noting 3.2.46 is the oldest version tested and older ones might be vulnerable too. It names 4.2.16 as the patched release. It does not mention 3.2.50.
- Because these differ, take the vendor or CERT Polska guidance for your firmware line.
- Access needed: the administrative portal of the router.
- Severity: High, CVSS 7.2, per the record. CERT Polska's page gives no score. The KEV flag is false.
How to check if you're exposed
- Sign in to the router administration page and read the firmware version on the status page.
- Compare it with the patched versions above. Treat anything below 4.2.16 as needing attention unless the vendor says your line is fixed in a 3.2.x release.
- Check whether the administrative portal is reachable from the WAN side. It should not be.
- Review who knows the administrator password, and whether it is still the factory default.
What to do now
- Update the firmware to the fixed version supplied by KAON or your service provider.
- Turn off remote administration from the internet.
- Change the administrator password to a unique one.
- Restrict portal access to a management VLAN or specific addresses where the device supports it.
- If the router came from an internet provider, ask the provider about update status, since they often control firmware.
Why it matters
The record lists CWE-78, OS command injection, and CWE-77. A value in a web request is passed into a shell command on the device without proper neutralisation. The device runs commands as a high privilege user, so success usually means full control of the router.
The need for administrative portal access lowers the exposure. But routers are often left with default or shared passwords, and some are managed remotely. A command injection behind a weak login is not much of a barrier.
Network devices matter in inventories because they sit on the path of everything else. Include them in the same asset list you use for software, with firmware version and owner.
Quick check
Can anyone on the internet exploit this?
Only with access to the administrative portal, per the record. Keeping that portal off the internet is the key mitigation.
Why do two sources list different versions?
The record says before 3.2.50 and 4.2.16. CERT Polska says 3.2.46 up to before 4.2.16. Verify with KAON.
Sources
Last reviewed: 19 October 2026.
