medium6.8
CVE-2022-25213
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot…
Impact
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phicomm | K2 Firmware | through 22.5.9.163 |
| Phicomm | K3 Firmware | through 21.5.37.246 |
| Phicomm | K3c Firmware | through 32.1.15.93 |
| Phicomm | K2g Firmware | through 22.6.3.20 |
| Phicomm | K2p Firmware | through 20.4.1.7 |