CVE-2022-25218 Weak cryptography in Phicomm Routers
Unauthenticated attackers can exploit weak RSA padding in telnetd to achieve root shell access on Phicomm routers via crafted UDP packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25218?
CVE-2022-25218 is a high-severity vulnerability in Phicomm Routers, published on 7 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).
Weakness: CWE-327
Which versions are affected by CVE-2022-25218?
It affects 5 products.
Products include Phicomm K2 Firmware, Phicomm K2g Firmware, Phicomm K2p Firmware, Phicomm K3 Firmware, Phicomm K3c Firmware.
How do I fix CVE-2022-25218?
No fix has been published for CVE-2022-25218 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25218 being exploited?
There is no known exploitation of CVE-2022-25218 in the wild and no public exploit code.
Other vulnerabilities in Phicomm Routers
Sources
Also known as GHSA-j9f3-j4r5-j83v.