K2 Firmware
CVE-2023-40796
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.
AnalysisAI
Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call. Affected products include: Phicomm K2 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
More in K2 Firmware
View allA null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair o
The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated at
Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network t
Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensiti
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical acce
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove)
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today