Medium severity5.3NVD Advisory· Published Mar 10, 2022· Updated Jun 17, 2026

CVE-2022-25215

Description

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Phicomm/K2 Firmware
cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:*
Range: <=22.5.9.163
Phicomm/K2g Firmware
cpe:2.3:o:phicomm:k2g_firmware:*:*:*:*:*:*:*:*
Range: <=22.6.3.20
Phicomm/K2p Firmware
cpe:2.3:o:phicomm:k2p_firmware:*:*:*:*:*:*:*:*
Range: <=20.4.1.7
Phicomm/K3 Firmware
cpe:2.3:o:phicomm:k3_firmware:*:*:*:*:*:*:*:*
Range: <=21.5.37.246
Phicomm/K3c Firmware
cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:*
Range: <=32.1.15.93

Patches

Vulnerability mechanics

References

www.tenable.com/security/research/tra-2022-01nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000