CVE-2022-25215 Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MA...
MediumCVSS 5.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phicomm k2 firmware | <= 22.5.9.163 | No fix listed |
| phicomm k3 firmware | <= 21.5.37.246 | No fix listed |
| phicomm k3c firmware | <= 32.1.15.93 | No fix listed |
| phicomm k2g firmware | <= 22.6.3.20 | No fix listed |
| phicomm k2p firmware | <= 20.4.1.7 | No fix listed |
References
- www.tenable.com exploit third-party-advisory