CVE-2022-48070

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

Command injection

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

Command injection

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48070

Phicomm K2 devices (v22.6.534.263) are affected by CVE-2022-48070, a command‑injection vulnerability in the automatic upgrade function exposed via the autoUpTime parameter. The issue is rooted in the upgrade mechanism allowing arbitrary command execution with local attacker access and low privile...

CVE-2022-48072

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48072

Phicomm K2G v22.6.3.20 is affected by a command injection vulnerability in the automatic upgrade function, exploitable via the autoUpTime parameter. The root cause is improper handling of input in the upgrade process, allowing arbitrary commands to be executed with the device’s privileges. CVSSv3...

PHICOMM K2 Remote Code Execution Vulnerability

The PHICOMM K2 is a wireless router from the Chinese company PHICOMM. A remote code execution vulnerability exists in /usr/lib/lua/luci/controller/admin/autoupgrade.lua in PHICOMM K2 version V22.5.9.163, which can be exploited to execute arbitrary commands using shell metacharacters in the...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...