CVE-2022-28372: Malicious File Upload
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtcfwupgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file upload to the device. This occurs in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wncjsonsh/wnccrtcfw.sh (ODU).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28372?
CVE-2022-28372 is rated as a high-severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2022-28372?
To mitigate CVE-2022-28372, update your Verizon 5G Home devices to the latest firmware versions: Indoor Unit to 3.4.66.163 or later and Outdoor Unit to 3.33.101.1 or later.
What devices are affected by CVE-2022-28372?
CVE-2022-28372 affects the Verizon 5G Home Indoor Unit firmware version 3.4.66.162 and Outdoor Unit firmware version 3.33.101.0.
Can CVE-2022-28372 lead to remote code execution?
Yes, CVE-2022-28372 can lead to remote code execution if an attacker successfully uploads malicious files to the vulnerable endpoints.
Is there a workaround for CVE-2022-28372 if I cannot update immediately?
A possible workaround for CVE-2022-28372 is to restrict access to the vulnerable endpoints until the firmware can be updated.