How severe is CVE-2022-25214?

CVE-2022-25214 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.

Is CVE-2022-25214 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-25214?

CVE-2022-25214 primarily affects Phicomm K2 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-25214?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-25214 published?

CVE-2022-25214 was published on 2022-03-10 and last updated on 2026-06-17.

CVE-2022-25214

CVE-2022-25214 is a high-severity vulnerability in Phicomm K2 Firmware with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.4)
CVSS v2: 5.8
EPSS exploit prediction: 1% (71st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Phicomm K2 Firmware
Published: 2022-03-10
Last modified: 2026-06-17

Description

Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.

Frequently asked questions

What is CVE-2022-25214?: Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.
How severe is CVE-2022-25214?: CVE-2022-25214 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
Is CVE-2022-25214 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-25214?: CVE-2022-25214 primarily affects Phicomm K2 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-25214?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-25214 published?: CVE-2022-25214 was published on 2022-03-10 and last updated on 2026-06-17.

References

https://www.tenable.com/security/research/tra-2022-01

Affected products (5)

cpe:2.3:o:phicomm:k2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phicomm:k3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phicomm:k3c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phicomm:k2g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:phicomm:k2p_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Phicomm K2 Firmware

CVE-2022-25219 — High (CVSS 8.4): A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair…
CVE-2022-25218 — High (CVSS 8.1): The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated…
CVE-2023-40796 — High (CVSS 7.8): Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.
CVE-2022-48072 — High (CVSS 7.8): Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the…
CVE-2022-48070 — High (CVSS 7.8): Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in…
CVE-2022-25217 — High (CVSS 7.8): Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network…

All CVEs affecting Phicomm K2 Firmware →