Phicomm
18 CVEs across 21 Phicomm products. Browse Phicomm vulnerabilities, severities, and proof-of-concept exploits.
Phicomm products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40796 | High | 7.8 | 2023-08-25 | Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. |
CVE-2022-48073 | High | 7.5 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48072 | High | 7.8 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48071 | High | 7.5 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48070 | High | 7.8 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-37779 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the send… |
CVE-2022-37778 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the curr… |
CVE-2022-37777 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (RCE) vulnerability v… |
CVE-2022-37780 | High | 7.2 | 2022-09-07 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the ping… |
CVE-2022-27373 | High | 8.8 | 2022-07-19 | Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping… |
CVE-2022-25219 | High | 8.4 | 2022-03-10 | A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2022-25217 | High | 7.8 | 2022-03-10 | Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device ove… |
CVE-2022-25215 | Medium | 5.3 | 2022-03-10 | Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a li… |
CVE-2022-25214 | High | 7.4 | 2022-03-10 | Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on th… |
CVE-2022-25213 | Medium | 6.8 | 2022-03-10 | Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot… |
CVE-2019-19117 | High | 8.8 | 2019-11-18 | /usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shel… |
CVE-2017-11495 | Critical | 9.8 | 2017-07-20 | PHICOMM K2(PSG1218) devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the a… |