What is the CVSS score of CVE-2022-25215?

CVE-2022-25215 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 1.1%.

Is there a public PoC exploit available for CVE-2022-25215?

Yes, a public proof-of-concept exploit is available for CVE-2022-25215. Prioritise patching immediately. EPSS: 1.1%.

K3 Firmware CVE-2022-25215

MEDIUM

2022-03-10 vulnreport@tenable.com

Information Disclosure K3 Firmware K2 Firmware K3C Firmware K2G Firmware K2P Firmware Phicomm

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Mar 10, 2022 - 17:47 nvd

MEDIUM 5.3

DescriptionNVD

AnalysisAI

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself. Affected products include: Phicomm K2 Firmware, Phicomm K3 Firmware, Phicomm K3C Firmware, Phicomm K2G Firmware, Phicomm K2P Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.