ID
VAR-202203-0219
CVE
CVE-2022-25219
TITLE
plural PHICOMM Product Interpretation Conflict Vulnerability
Trust: 0.8
DESCRIPTION
A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a crafted exchange of UDP packets, an unauthenticated attacker on the local network can leverage this null byte interaction error in such a way as to make those ephemeral passwords predictable (with 1-in-94 odds). Since the attacker must manipulate data processed by the OpenSSL function RSA_public_decrypt(), successful exploitation of this vulnerability depends on the use of an unpadded RSA cipher (CVE-2022-25218). k2 firmware, k3 firmware, k3c firmware etc. PHICOMM The product contains an interpretation conflict vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | phicomm | model: | k3c | scope: | lte | version: | 32.1.15.93 | Trust: 1.0 |
| vendor: | phicomm | model: | k2p | scope: | lte | version: | 20.4.1.7 | Trust: 1.0 |
| vendor: | phicomm | model: | k3 | scope: | lte | version: | 21.5.37.246 | Trust: 1.0 |
| vendor: | phicomm | model: | k2g | scope: | lte | version: | 22.6.3.20 | Trust: 1.0 |
| vendor: | phicomm | model: | k2 | scope: | lte | version: | 22.5.9.163 | Trust: 1.0 |
| vendor: | phicomm | model: | k3 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | phicomm | model: | k2 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | phicomm | model: | k3c | scope: | - | version: | - | Trust: 0.8 |
| vendor: | phicomm | model: | k2p | scope: | - | version: | - | Trust: 0.8 |
| vendor: | phicomm | model: | k2g | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
| problemtype: | Interpretation conflict (CWE-436) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Phicomm Various product security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=185413 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2022-25219 | Trust: 3.2 |
| db: | TENABLE | id: | TRA-2022-01 | Trust: 2.4 |
| db: | JVNDB | id: | JVNDB-2022-006582 | Trust: 0.8 |
| db: | CS-HELP | id: | SB2022030909 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202203-801 | Trust: 0.6 |
REFERENCES
| url: | https://www.tenable.com/security/research/tra-2022-01 | Trust: 2.4 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2022-25219 | Trust: 0.8 |
| url: | https://cxsecurity.com/cveshow/cve-2022-25219/ | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2022030909 | Trust: 0.6 |
SOURCES
| db: | JVNDB | id: | JVNDB-2022-006582 |
| db: | CNNVD | id: | CNNVD-202203-801 |
| db: | NVD | id: | CVE-2022-25219 |
LAST UPDATE DATE
2024-11-23T21:50:40.689000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2022-006582 | date: | 2023-07-06T08:11:00 |
| db: | CNNVD | id: | CNNVD-202203-801 | date: | 2022-03-18T00:00:00 |
| db: | NVD | id: | CVE-2022-25219 | date: | 2024-11-21T06:51:49.703 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2022-006582 | date: | 2023-07-06T00:00:00 |
| db: | CNNVD | id: | CNNVD-202203-801 | date: | 2022-03-09T00:00:00 |
| db: | NVD | id: | CVE-2022-25219 | date: | 2022-03-10T17:47:02.457 |