Improper access control on the LocalClientList.asp interface allows an unauthenticated…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Phicomm Routers | K2G A1 >= 22.6.3.20, K2 A7 >= 22.6.506.28, K2G A1 >= 22.6.3.20 | — | No fix listed | CNA |
- Phicomm Routers Vendor— Affected K2G A1 >= 22.6.3.20, K2 A7 >= 22.6.506.28, K2G A1 >= 22.6.3.20 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:* | up to 22.5.9.163 | Vulnerable | Phicomm |
| cpe:2.3:h:phicomm:k2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phicomm |
| cpe:2.3:o:phicomm:k3_firmware:*:*:*:*:*:*:*:* | up to 21.5.37.246 | Vulnerable | Phicomm |
| cpe:2.3:h:phicomm:k3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phicomm |
| cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:* | up to 32.1.15.93 | Vulnerable | Phicomm |
| cpe:2.3:h:phicomm:k3c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phicomm |
| cpe:2.3:o:phicomm:k2g_firmware:*:*:*:*:*:*:*:* | up to 22.6.3.20 | Vulnerable | Phicomm |
| cpe:2.3:h:phicomm:k2g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phicomm |
| cpe:2.3:o:phicomm:k2p_firmware:*:*:*:*:*:*:*:* | up to 20.4.1.7 | Vulnerable | Phicomm |
| cpe:2.3:h:phicomm:k2p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Phicomm |
- cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:* Versions up to 22.5.9.163 Vulnerable ·Phicomm
- cpe:2.3:h:phicomm:k2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
- cpe:2.3:o:phicomm:k3_firmware:*:*:*:*:*:*:*:* Versions up to 21.5.37.246 Vulnerable ·Phicomm
- cpe:2.3:h:phicomm:k3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
- cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:* Versions up to 32.1.15.93 Vulnerable ·Phicomm
- cpe:2.3:h:phicomm:k3c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
- cpe:2.3:o:phicomm:k2g_firmware:*:*:*:*:*:*:*:* Versions up to 22.6.3.20 Vulnerable ·Phicomm
- cpe:2.3:h:phicomm:k2g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
- cpe:2.3:o:phicomm:k2p_firmware:*:*:*:*:*:*:*:* Versions up to 20.4.1.7 Vulnerable ·Phicomm
- cpe:2.3:h:phicomm:k2p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25214
- 2026-10-03 Alias added: GHSA-pw2w-8885-2537
References
More Phicomm K2 Firmware vulnerabilities
- TI-2022-23797 Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. CVSS 3.1HIGH 7.5
- TI-2022-23795 Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. CVSS 3.1HIGH 7.5
- TI-2023-21549 Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. CVSS 3.1HIGH 7.8
- TI-2022-23796 Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via… CVSS 3.1HIGH 7.8
- TI-2022-23794 Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via… CVSS 3.1HIGH 7.8
- TI-2022-08932 A null byte interaction error has been discovered in the code that the telnetd_startup… CVSS 3.1HIGH 8.4
Sources
- CVE-2022-25214 · CVE Program
- CVE-2022-25214 · NVD
- FIRST EPSS
- GHSA-pw2w-8885-2537 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences