TI-2022-08930 Aliases CVE-2022-25217 GHSA-vvvr-4847-2p4f

Hard-coded credentials in Phicomm Routers

LOW 34CWE-798Published 2022-03-07 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware (possibly amongst many other releases) included both the private and public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An attacker in possession of the leaked private key may, through a scripted exchange of UDP packets, instruct telnetd_startup to spawn an unauthenticated telnet shell as root, by means of which they can then obtain complete control of the device. A consequence of the limited availablility of firmware images for testing is that models and versions not listed here may share this vulnerability.

Why it matters now

EPSS 0.00329 26th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Phicomm Routers	K2 22.5.9.163, K3 21.5.37.246, K3C 32.1.15.93 -- 32.1.26.175, K3C 33.1.25.177, K2P 20.4.1.7, K2 A7 22.6.506.28	—	No fix listed	CNA

Phicomm Routers Vendor— Affected K2 22.5.9.163, K3 21.5.37.246, K3C 32.1.15.93 -- 32.1.26.175, K3C 33.1.25.177, K2P 20.4.1.7, K2 A7 22.6.506.28 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:phicomm:k2_firmware::::::::	up to 22.5.9.163	Vulnerable	Phicomm
cpe:2.3:h:phicomm:k2:-:::::::*	not specified by NVD	Running on	Phicomm
cpe:2.3:o:phicomm:k3c_firmware::::::::	up to 32.1.15.93	Vulnerable	Phicomm
cpe:2.3:h:phicomm:k3c:-:::::::*	not specified by NVD	Running on	Phicomm

cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:* Versions up to 22.5.9.163 Vulnerable ·Phicomm
cpe:2.3:h:phicomm:k2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm
cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:* Versions up to 32.1.15.93 Vulnerable ·Phicomm
cpe:2.3:h:phicomm:k3c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Phicomm

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-25217
2026-10-03 Alias added: GHSA-vvvr-4847-2p4f

References

Exploit 1

https://www.tenable.com/security/research/tra-2022-01

TI-2022-23797 Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. CVSS 3.1HIGH 7.5
TI-2022-23795 Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. CVSS 3.1HIGH 7.5
TI-2023-21549 Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. CVSS 3.1HIGH 7.8
TI-2022-23796 Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via… CVSS 3.1HIGH 7.8
TI-2022-23794 Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via… CVSS 3.1HIGH 7.8
TI-2022-08932 A null byte interaction error has been discovered in the code that the telnetd_startup… CVSS 3.1HIGH 8.4

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences