PT-2022-18981 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Published 2022-07-14 · Updated 2022-07-21 · CVE-2022-28372

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0

Description The CRTC and ODU RPC endpoints in the affected devices provide a means of provisioning a firmware update via crtc fw upgrade or crtcfwimage. However, the URL provided is not validated, allowing for arbitrary file upload to the device. This issue is present in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wnc jsonsh/wnc crtc fw.sh (ODU).

Recommendations For Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162, consider disabling the crtc fw upgrade and crtcfwimage functions until a patch is available. For Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0, restrict access to the /lib/functions/wnc jsonsh/wnc crtc fw.sh script to minimize the risk of exploitation. As a temporary workaround, avoid using the crtc fw upgrade and crtcfwimage functions in the affected API endpoints until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-28372

Affected Products

Verizon 5G Home Lvskihp Outdoorunit

References · 6

• 🔥 https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md · Exploit
• https://verizon.com/info/reportsecurityvulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28372 · Security Note
• https://t.me/cibsecurity/46229 · Telegram Post
• https://t.me/cvenotify/33066 · Telegram Post