Non notée
CVE-2022-25218 The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated…
Description
The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Phicomm Routers | Versions non publiées |
Autres CVE de Phicomm Routers
Les 6 CVE de Phicomm Routers →
CVE-2022-25219
A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair…
Non notée
CVE-2022-25213
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical…
Non notée
CVE-2022-25215
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove)…
Non notée
CVE-2022-25217
Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network…
Non notée