CVE-2022-25214

Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.

• https://www.tenable.com/security/research/tra-2022-01Exploit, Third Party Advisory
• https://www.tenable.com/security/research/tra-2022-01Exploit, Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25209Jenkins Chef Sinatra Plugin 1.20 and earlier does not config…8.8
• CVE-2022-2521It was found in libtiff 4.4.0rc1 that there is an invalid po…6.5
• CVE-2022-25210Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier us…6.5
• CVE-2022-25211A missing permission check in Jenkins SWAMP Plugin 1.2.6 and…8.8
• CVE-2022-25212A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2022-25213Improper physical access control and use of hard-coded crede…6.8
• CVE-2022-25215Improper access control on the LocalMACConfig.asp interface …5.3
• CVE-2022-25216An absolute path traversal vulnerability allows a remote att…7.5
• CVE-2022-25217Use of a hard-coded cryptographic key pair by the telnetd_st…7.8
• CVE-2022-25218The use of the RSA algorithm without OAEP, or any other padd…8.1
• CVE-2022-25219A null byte interaction error has been discovered in the cod…8.4
• CVE-2022-2522Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8