PT-2022-18980 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Matthew Lichtenberger + 1 · Published 2022-07-14 · Updated 2023-08-08 · CVE-2022-28371

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0

Description The CRTC and ODU RPC endpoints rely on a static certificate for access control, which is embedded in the firmware and identical across devices. An attacker can gain access by downloading the firmware and extracting the private components of the certificates from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem. The firmware download location is shown in a device's upgrade logs.

Recommendations For Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162, consider disabling the CRTC and ODU RPC endpoints until a patch is available. For Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0, restrict access to the /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem files to minimize the risk of exploitation. As a temporary workaround, avoid using the static certificate for access control until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-28371

Affected Products

Verizon 5G Home Lvskihp Outdoorunit

References · 6

• 🔥 https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md · Exploit
• https://verizon.com/info/reportsecurityvulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28371 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28371 · Vendor Advisory
• https://t.me/cvenotify/33067 · Telegram Post
• https://t.me/cibsecurity/46230 · Telegram Post