CVE-2022-25215

published 2022-03-10

CVE-2022-25215: Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a…

Priority P4 29 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
phicomm	k2_firmware	<= 22.5.9.163	—
phicomm	k2g_firmware	<= 22.6.3.20	—
phicomm	k2p_firmware	<= 20.4.1.7	—
phicomm	k3_firmware	<= 21.5.37.246	—
phicomm	k3c_firmware	<= 32.1.15.93	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863