Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shel

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• phicomm k2 firmwareup to 22.5.9.163 inclusive
• phicomm k3c firmwareup to 32.1.15.93 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (tenable). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Phicomm Routers

  • K2 22.5.9.163, K3 21.5.37.246, K3C 32.1.15.93 -- 32.1.26.175, K3C 33.1.25.177, K2P 20.4.1.7, K2 A7 22.6.506.28affected

Other highest-scoring records for the same primary product.

• CVE-2022-25219A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral password
  33Monitor
• CVE-2022-25218The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local
  32Monitor
• CVE-2023-40796Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.
  31Monitor
• CVE-2022-48072Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade fun
  31Monitor
• CVE-2022-48070Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade f
  31Monitor
• CVE-2022-48073Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

For convenience in support or manufacturing, an account that is identical on every device is embedded in the software. Credentials learned from one device work on all of them.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const SUPPORT_USER = "support";2const SUPPORT_PASS = "hardcoded-password";

1const creds = await provisioning.deviceCredentials(deviceId);2if (creds.mustRotate) await forcePasswordChange(deviceId);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.