{"cve":"CVE-2022-25214","nvd":{"published":"2022-03-10T17:47:01.153","modified":"2026-06-17T04:33:13.113","status":"Modified","description":"Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","score":7.4},"cwes":[],"references":["https://www.tenable.com/security/research/tra-2022-01","https://www.tenable.com/security/research/tra-2022-01"],"products":["phicomm:k2_firmware","phicomm:k2g_firmware","phicomm:k2p_firmware","phicomm:k3_firmware","phicomm:k3c_firmware"],"source":"nvd","synced_at":"2026-10-19T21:29:06.454770966+00:00"},"epss":{"cve":"CVE-2022-25214","score":0.01495,"percentile":0.74189,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}