CVE-2022-28371: High severity verizon lvskihp vulnerability
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28371?
CVE-2022-28371 is considered a high severity vulnerability due to its potential for unauthorized access through static certificate exploitation.
How do I fix CVE-2022-28371?
To mitigate CVE-2022-28371, update your Verizon 5G Home LVSKIHP InDoorUnit firmware to version 3.4.66.163 or the OutDoorUnit to version 3.33.101.1, which addresses the security vulnerability.
What systems are affected by CVE-2022-28371?
CVE-2022-28371 affects Verizon LVSKIHP InDoorUnit firmware version 3.4.66.162 and OutDoorUnit firmware version 3.33.101.0.
What kind of attack can exploit CVE-2022-28371?
An attacker can exploit CVE-2022-28371 by using the static certificate to gain unauthorized access through the CRTC and ODU RPC endpoints.
Is there a way to check if my device is vulnerable to CVE-2022-28371?
You can check if your device is vulnerable to CVE-2022-28371 by verifying the firmware version against the affected versions listed.