SB2022030909 - Multiple vulnerabilities in Phicomm Routers

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2022-25214)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the LocalClientList.asp interface. A remote attacker can bypass implemented security restrictions and obtain sensitive information concerning devices on the local area network, including IP and MAC addresses.

2) Improper access control (CVE-ID: CVE-2022-25215)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the LocalMACConfig.asp interface. A remote attacker can add (or remove) client MAC addresses to (or from) a list of banned hosts and perform a denial of service (DoS) attack.

3) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2022-25217)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected product has a hardcoded private key pair by the telnetd_startup service. A remote attacker on the local network can obtain a root shell on the device over telnet.

4) Improper access control (CVE-ID: CVE-2022-25218)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the use of the RSA algorithm without OAEP or any other padding scheme in telnetd_startup. A remote attacker on the local network can manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device.

5) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2022-25219)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a null byte interaction error in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords. A remote attacker on the local network can use specially crafted UDP packets and make those ephemeral passwords predictable.

6) Use of hard-coded credentials (CVE-ID: CVE-2022-25213)

The vulnerability allows a local attacker to gain full access to vulnerable system.

The vulnerability exists due to improper access control and use of hard-coded credentials in /etc/passwd. An attacker with physical access can obtain a root shell via an unprotected UART port on the device.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.tenable.com/security/research/tra-2022-01