CVE-2022-25214: Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on…

PriorityP349high7.4CVSS 3.1

AVNACHPRNUINSUCHINAH

EPSS

1.47%

70.5th percentile

Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
phicomm	k2_firmware	<= 22.5.9.163	—
phicomm	k2g_firmware	<= 22.6.3.20	—
phicomm	k2p_firmware	<= 20.4.1.7	—
phicomm	k3_firmware	<= 21.5.37.246	—
phicomm	k3c_firmware	<= 32.1.15.93	—

CVSS provenance

nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.