SB2022030909 - Multiple vulnerabilities in Phicomm Routers

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022030909

SB2022030909 - Multiple vulnerabilities in Phicomm Routers

Published: March 9, 2022

Security Bulletin ID SB2022030909
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2022-25214)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the LocalClientList.asp interface. A remote attacker can bypass implemented security restrictions and obtain sensitive information concerning devices on the local area network, including IP and MAC addresses.


2) Improper access control (CVE-ID: CVE-2022-25215)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the LocalMACConfig.asp interface. A remote attacker can add (or remove) client MAC addresses to (or from) a list of banned hosts and perform a denial of service (DoS) attack.


3) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-25217)

CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected product has a hardcoded private key pair by the telnetd_startup service. A remote attacker on the local network can obtain a root shell on the device over telnet.


4) Improper access control (CVE-ID: CVE-2022-25218)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the use of the RSA algorithm without OAEP or any other padding scheme in telnetd_startup. A remote attacker on the local network can manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device.


5) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2022-25219)

CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a null byte interaction error in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords. A remote attacker on the local network can use specially crafted UDP packets and make those ephemeral passwords predictable.


6) Use of hard-coded credentials (CVE-ID: CVE-2022-25213)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to gain full access to vulnerable system.

The vulnerability exists due to improper access control and use of hard-coded credentials in /etc/passwd. An attacker with physical access can obtain a root shell via an unprotected UART port on the device.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References