CVE-2019-19117: Phicomm k2(psg1218) Firmware

High severity, CVSS 8.8. EPSS: 5% chance of exploitation in the next 30 days.

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter.

Affected products

• Phicomm k2(psg1218) Firmware: version 22.5.9.163 only

Published 2019-11-18. Last modified 2026-06-17.