Lucene search

TenableCVE-2022-25215

HistoryMar 10, 2022 - 5:47 p.m.

CVE-2022-25215

2022-03-1017:47:01

tenable

web.nvd.nist.gov

cve-2022-25215

improper access control

localmacconfig.asp

unauthenticated remote attacker

banned hosts

mac addresses

wan

router

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.

Affected configurations

Nvd

Node

phicommk2_firmwareRange≤22.5.9.163

AND

phicommk2Match-

Node

phicommk3_firmwareRange≤21.5.37.246

AND

phicommk3Match-

Node

phicommk3c_firmwareRange≤32.1.15.93

AND

phicommk3cMatch-

Node

phicommk2g_firmwareRange≤22.6.3.20

AND

phicommk2gMatch-

Node

phicommk2p_firmwareRange≤20.4.1.7

AND

phicommk2pMatch-

VendorProductVersionCPE
phicommk2_firmware*cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:*
phicommk2-cpe:2.3:h:phicomm:k2:-:*:*:*:*:*:*:*
phicommk3_firmware*cpe:2.3:o:phicomm:k3_firmware:*:*:*:*:*:*:*:*
phicommk3-cpe:2.3:h:phicomm:k3:-:*:*:*:*:*:*:*
phicommk3c_firmware*cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:*
phicommk3c-cpe:2.3:h:phicomm:k3c:-:*:*:*:*:*:*:*
phicommk2g_firmware*cpe:2.3:o:phicomm:k2g_firmware:*:*:*:*:*:*:*:*
phicommk2g-cpe:2.3:h:phicomm:k2g:-:*:*:*:*:*:*:*
phicommk2p_firmware*cpe:2.3:o:phicomm:k2p_firmware:*:*:*:*:*:*:*:*
phicommk2p-cpe:2.3:h:phicomm:k2p:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phicomm	k2_firmware	*	cpe:2.3:o:phicomm:k2_firmware::::::::
phicomm	k2	-	cpe:2.3:h:phicomm:k2:-:::::::*
phicomm	k3_firmware	*	cpe:2.3:o:phicomm:k3_firmware::::::::
phicomm	k3	-	cpe:2.3:h:phicomm:k3:-:::::::*
phicomm	k3c_firmware	*	cpe:2.3:o:phicomm:k3c_firmware::::::::
phicomm	k3c	-	cpe:2.3:h:phicomm:k3c:-:::::::*
phicomm	k2g_firmware	*	cpe:2.3:o:phicomm:k2g_firmware::::::::
phicomm	k2g	-	cpe:2.3:h:phicomm:k2g:-:::::::*
phicomm	k2p_firmware	*	cpe:2.3:o:phicomm:k2p_firmware::::::::
phicomm	k2p	-	cpe:2.3:h:phicomm:k2p:-:::::::*

CNA Affected

[
  {
    "product": "Phicomm Routers",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "K2G A1 >= 22.6.3.20, K2 A7 >= 22.6.506.28, K2G A1 >= 22.6.3.20"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2022-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

Related for CVE-2022-25215