PT-2022-17153 · Phicomm · K2 Firmware+1

Olivia Lucca Fraser · Published 2022-03-07 · Updated 2023-08-08 · CVE-2022-25214

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions No specific software or version information is provided.

Description The issue concerns improper access control on certain interfaces, allowing an unauthenticated remote attacker to obtain sensitive information. This includes data about devices on the local area network, such as IP and MAC addresses, and WPA passphrases for wireless networks. The vulnerability is particularly dangerous because it can expose the administrative interface password if the same password is used for the wireless network and the administrative interface. When Remote Management is enabled, the vulnerable endpoints are exposed to the WAN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-25214

Affected Products

K2 Firmware

K3C Firmware

References · 3

• 🔥 https://tenable.com/security/research/tra-2022-01 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25214 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25214 · Vendor Advisory