Phicomm K2
11 CVEs affecting Phicomm K2. Latest disclosed: 2023-08-25. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25219 | High | 8.4 | 2022-03-10 | A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2023-40796 | High | 7.8 | 2023-08-25 | Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. |
CVE-2022-48072 | High | 7.8 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48070 | High | 7.8 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-25217 | High | 7.8 | 2022-03-10 | Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device ove… |
CVE-2022-48073 | High | 7.5 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48071 | High | 7.5 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-25214 | High | 7.4 | 2022-03-10 | Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on th… |
CVE-2022-25213 | Medium | 6.8 | 2022-03-10 | Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot… |
CVE-2022-25215 | Medium | 5.3 | 2022-03-10 | Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a li… |