CVE-2022-25215
Last modified
CVE-2022-25215 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.. EPSS estimates a 1.13% chance of exploitation in the next 30 days.
Description
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phicomm | K2 Firmware | <= 22.5.9.163 |
| Phicomm | K3 Firmware | <= 21.5.37.246 |
| Phicomm | K3c Firmware | <= 32.1.15.93 |
| Phicomm | K2g Firmware | <= 22.6.3.20 |
| Phicomm | K2p Firmware | <= 20.4.1.7 |
References
- https://www.tenable.com/security/research/tra-2022-01Exploit, Third Party Advisory
- https://www.tenable.com/security/research/tra-2022-01Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25215?
How severe is CVE-2022-25215?
How do I fix CVE-2022-25215?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2521It was found in libtiff 4.4.0rc1 that there is an invalid po…6.5
- CVE-2022-25210Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier us…6.5
- CVE-2022-25211A missing permission check in Jenkins SWAMP Plugin 1.2.6 and…8.8
- CVE-2022-25212A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
- CVE-2022-25213Improper physical access control and use of hard-coded crede…6.8
- CVE-2022-25214Improper access control on the LocalClientList.asp interface…7.4
- CVE-2022-25216An absolute path traversal vulnerability allows a remote att…7.5
- CVE-2022-25217Use of a hard-coded cryptographic key pair by the telnetd_st…7.8
- CVE-2022-25218The use of the RSA algorithm without OAEP, or any other padd…8.1
- CVE-2022-25219A null byte interaction error has been discovered in the cod…8.4
- CVE-2022-2522Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
- CVE-2022-25220PeteReport Version 0.5 allows an authenticated admin user to…4.8
Are you affected by CVE-2022-25215?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST