CVE-2022-48071

Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext...

CVE-2022-48071

Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext...

PT-2023-15561

Name of the Vulnerable Software and Affected Versions Phicomm K2G version 22.6.3.20 Phicomm K2 version 22.6.534.263 Description The issue concerns the storage of sensitive information. Specifically, the root and admin passwords are stored in plaintext. This poses a significant security risk as it...

PT-2023-15558

Name of the Vulnerable Software and Affected Versions Phicomm K2 version 22.6.534.263 Description A command injection issue was discovered in the automatic upgrade function via the autoUpTime parameter. Recommendations For Phicomm K2 version 22.6.534.263, avoid using the autoUpTime parameter in t...

PT-2023-15559

Name of the Vulnerable Software and Affected Versions Phicomm K2 version 22.6.534.263 Description The issue concerns the storage of sensitive information. Specifically, the root and admin passwords are stored in plaintext. Recommendations For Phicomm K2 version 22.6.534.263, consider changing the...

CVE-2022-48070

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48070: Improper Neutralization of Special Elements used in an OS Command

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48071: Cleartext Storage of Sensitive Information

Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext...

CVE-2022-48070

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48071

Summary: CVE-2022-48071 affects Phicomm K2 firmware (v22.6.534.263) where root and admin passwords are stored in plaintext, enabling potential credential disclosure. Impact: Based on the linked metrics, CVSS v3.1 base score is 7.5 (HIGH) with network attack vector and no user interaction. Details...

CVE-2022-48070

Phicomm K2 devices (v22.6.534.263) are affected by CVE-2022-48070, a command‑injection vulnerability in the automatic upgrade function exposed via the autoUpTime parameter. The issue is rooted in the upgrade mechanism allowing arbitrary command execution with local attacker access and low privile...

CVE-2022-25217

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

CVE-2022-25217

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

Phicomm’s multiple products have security vulnerabilities

PHICOMM K2 and others are products of PHICOMM, a Chinese company.PHICOMM K2 is a wireless router.PHICOMM K3 is a dual-band Gigabit wireless WiFi router.PHICOMM K3C is a dual-band Gigabit wireless WiFi router.PHICOMM K3C is a dual-band Gigabit wireless WiFi router.PHICOMM K3C is a dual-band Gigabi...

PT-2022-17156

Name of the Vulnerable Software and Affected Versions K2 firmware version 22.5.9.163 K3C firmware version 32.1.15.93 Description The issue allows an attacker on the local area network to obtain a root shell on the device over telnet due to the use of a hard-coded cryptographic key pair by the...

CVE-2022-25217: Use of Hard-coded Credentials

Use of a hard-coded cryptographic key pair by the telnetdstartup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetdstartup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware...

VulnCheck KEV: CVE-2018-7482

The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1../configuration.php&download=1 request. The specific pathname ../configuration.php should b...

k2-systems.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148431 Security Researcher Hchabik Helped patch 2424 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting k2-systems.com website and...

GHSA-2GC7-W4HW-RR2M class.upload.php in verot.net omits .pht from the set of dangerous file extensions

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576...

Remote code execution in verot/class.upload.php

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...