What’s Vulnerable › Vulnerabilities

CVE-2022-25218

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-10 · updated 2026-06-17
• Weakness: CWE-327

Description

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).

Affected products

• Phicomm K2 Firmware: through 22.5.9.163
• Phicomm K2G Firmware: through 22.6.3.20
• Phicomm K2P Firmware: through 20.4.1.7
• Phicomm K3 Firmware: through 21.5.37.246
• Phicomm K3C Firmware: through 32.1.15.93

References

• https://www.tenable.com/security/research/tra-2022-01
• https://www.tenable.com/security/research/tra-2022-01

Get alerted when CVE-2022-25218 or the next vulnerability affects your stack