CVEvulnerability

CVE-2022-25215

5.3 MEDIUM Published 2022-03-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.

Affected configurations

• phicomm k2 firmware (<= 22.5.9.163) • phicomm k3 firmware (<= 21.5.37.246) • phicomm k3c firmware (<= 32.1.15.93) • phicomm k2g firmware (<= 22.6.3.20) • phicomm k2p firmware (<= 20.4.1.7)

References