CVE-2022-48070

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

Command injection

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

Command injection

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48072: Improper Neutralization of Special Elements used in an OS Command

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48072

Phicomm K2G v22.6.3.20 is affected by a command injection vulnerability in the automatic upgrade function, exploitable via the autoUpTime parameter. The root cause is improper handling of input in the upgrade process, allowing arbitrary commands to be executed with the device’s privileges. CVSSv3...

CVE-2022-48070

Phicomm K2 devices (v22.6.534.263) are affected by CVE-2022-48070, a command‑injection vulnerability in the automatic upgrade function exposed via the autoUpTime parameter. The issue is rooted in the upgrade mechanism allowing arbitrary command execution with local attacker access and low privile...

PT-2023-15558

Name of the Vulnerable Software and Affected Versions Phicomm K2 version 22.6.534.263 Description A command injection issue was discovered in the automatic upgrade function via the autoUpTime parameter. Recommendations For Phicomm K2 version 22.6.534.263, avoid using the autoUpTime parameter in t...

PT-2023-15560

Name of the Vulnerable Software and Affected Versions Phicomm K2G version 22.6.3.20 Description The issue is related to a command injection vulnerability in the automatic upgrade function via the autoUpTime parameter. Recommendations For Phicomm K2G version 22.6.3.20, consider restricting access ...

CVE-2022-48072

Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

CVE-2022-48070: Improper Neutralization of Special Elements used in an OS Command

Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function...

PHICOMM K2 Remote Code Execution Vulnerability

The PHICOMM K2 is a wireless router from the Chinese company PHICOMM. A remote code execution vulnerability exists in /usr/lib/lua/luci/controller/admin/autoupgrade.lua in PHICOMM K2 version V22.5.9.163, which can be exploited to execute arbitrary commands using shell metacharacters in the...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

PT-2019-15771

Name of the Vulnerable Software and Affected Versions PHICOMM K2PSG1218 version V22.5.9.163 Description The issue allows remote authenticated users to execute any command via shell metacharacters in the autoUpTime parameter of the /usr/lib/lua/luci/controller/admin/autoupgrade.lua file. This can ...

CVE-2019-19117: Improper Neutralization of Special Elements used in an OS Command

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...