CVE-2022-28369

Published: Jul 14, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root.

Affected (1)

Products: Verizon: Lvskihp Indoorunit Firmware

1 product

Lvskihp Indoorunit Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Verizon Lvskihp Indoorunit Firmware	Version 3.4.66.162

Running on/with	Platform Versions
Verizon Lvskihp Indoorunit	All versions

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.verizon.com/info/reportsecurityvulnerability/

Source: cve@mitre.org

Vendor Advisory

https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.verizon.com/info/reportsecurityvulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.