N/A

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219).

N/A

N/A

多款PHICOMM产品加密问题漏洞

PHICOMM K2等都是中国斐讯（PHICOMM）公司的产品。PHICOMM K2是一款无线路由器。PHICOMM K3是一个双频千兆无线 WiFi 路由器。PHICOMM K3C是一个双频千兆无线 WiFi 路由器。 PHICOMM 多款产品存在加密问题漏洞，该漏洞允许本地网络上的远程攻击者获得设备上的根shell并获得对其他受限制功能的未经授权访问。

N/A

N/A