What’s Vulnerable › Vulnerabilities

CVE-2022-25213

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-10 · updated 2026-06-17
• Weakness: CWE-798

Description

Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.

Affected products

• Phicomm K2 Firmware: through 22.5.9.163
• Phicomm K2G Firmware: through 22.6.3.20
• Phicomm K2P Firmware: through 20.4.1.7
• Phicomm K3 Firmware: through 21.5.37.246
• Phicomm K3C Firmware: through 32.1.15.93

References

• https://www.tenable.com/security/research/tra-2022-01
• https://www.tenable.com/security/research/tra-2022-01

Get alerted when CVE-2022-25213 or the next vulnerability affects your stack