PT-2022-18986 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Published 2022-07-14 · Updated 2022-07-21 · CVE-2022-28377

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0

Description The issue concerns the use of a static account username and password for access control on the CRTC and ODU RPC endpoints. This password can be generated using a binary included in the firmware by obtaining the MAC address of the IDU's base Ethernet interface and modifying the /etc/device info file to include the string DEVICE MANUFACTURER='Wistron NeWeb Corp.'. The vulnerable endpoint is related to the file /etc/init.d/wnc factoryssidkeypwd on the IDU.

Recommendations For Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162, consider disabling access to the CRTC and ODU RPC endpoints until a patch is available. For Verizon 5G Home LVSKIHP OutDoorUnit (ODU) version 3.33.101.0, restrict access to the ODU RPC endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the static account username and password for access control on the affected devices until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2022-28377

Affected Products

Verizon 5G Home Lvskihp Outdoorunit

References · 5

• 🔥 https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md · Exploit
• https://verizon.com/info/reportsecurityvulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28377 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28377 · Vendor Advisory
• https://t.me/cibsecurity/46233 · Telegram Post