CVE-2022-25989

An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet can lead to authentication bypass. An attacker can DHCP poison to trigger this vulnerability.

• CWE-290
• CWE-290

• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1479Exploit, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1479Exploit, Third Party Advisory

Published

May 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25978All versions of the package github.com/usememos/memos/server…6.1
• CVE-2022-25979Versions of the package jsuites before 5.0.1 are vulnerable …6.1
• CVE-2022-2598Out-of-bounds Write to API in GitHub repository vim/vim prio…5.5
• CVE-2022-25980Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-25986Browse restriction bypass vulnerability in Scheduler of Cybo…4.3
• CVE-2022-25987Improper handling of Unicode encoding in source code to be c…9.8
• CVE-2022-2599The Anti-Malware Security and Brute-Force Firewall WordPress…6.1
• CVE-2022-25990On 1.0.x versions prior to 1.0.1, systems running F5OS-A sof…5.3
• CVE-2022-25992Insecure inherited permissions in the Intel(R) oneAPI Toolki…7.8
• CVE-2022-25995A command execution vulnerability exists in the console inha…8.8
• CVE-2022-25996A stack-based buffer overflow vulnerability exists in the co…9.8
• CVE-2022-25997Rejected reason: This candidate was in a CNA pool that was n…