CVE-2022-25213 Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same p...
MediumCVSS 6.8
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phicomm k2 firmware | <= 22.5.9.163 | No fix listed |
| phicomm k3 firmware | <= 21.5.37.246 | No fix listed |
| phicomm k3c firmware | <= 32.1.15.93 | No fix listed |
| phicomm k2g firmware | <= 22.6.3.20 | No fix listed |
| phicomm k2p firmware | <= 20.4.1.7 | No fix listed |
References
- www.tenable.com exploit third-party-advisory