Vulnerability in Phicomm K2
CVE-2022-25218
The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).
Vulnerability class: POODLE (CVE-2014-3566)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (61.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 61.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.tenable.com/security/research/tra-2022-01 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-25218?
- CVE-2022-25218 is a high-severity vulnerability in Phicomm K2, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 8.1/10. Published 2022-03-10.
- How severe is CVE-2022-25218?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2022-25218 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.