CVE-2022-28370: High severity verizon lvskihp vulnerability
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtcfwupgrade provides a means of provisioning a firmware update for the device. /lib/functions/wncjsonsh/wnccrtcfw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed firmware.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28370?
CVE-2022-28370 has a CVSS score that indicates a high severity level due to the lack of cryptographic validation in the firmware update process.
How do I fix CVE-2022-28370?
To fix CVE-2022-28370, ensure you update the firmware of your Verizon 5G Home Outdoor Unit to a patched version that includes cryptographic validation.
What are the risks associated with CVE-2022-28370?
CVE-2022-28370 allows attackers to potentially install malicious firmware, compromising the device and the network it's connected to.
Which devices are affected by CVE-2022-28370?
CVE-2022-28370 affects the Verizon 5G Home LVSKIHP Outdoor Unit version 3.33.101.0.
Is CVE-2022-28370 being actively exploited?
As of the latest updates, there is no indication that CVE-2022-28370 is being actively exploited in the wild, but the vulnerability should still be addressed promptly.