CVE-2022-28373: OS Command Injection
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code execution as root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28373?
CVE-2022-28373 is a critical severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2022-28373?
To fix CVE-2022-28373, you should update your Verizon 5G Home LVSKIHP Indoor Unit firmware to the latest version.
What types of attacks can be executed through CVE-2022-28373?
CVE-2022-28373 can allow remote attackers to inject shell metacharacters to execute arbitrary commands on the affected device.
Who is affected by CVE-2022-28373?
CVE-2022-28373 affects users of the Verizon 5G Home LVSKIHP Indoor Unit running firmware version 3.4.66.162.
Is CVE-2022-28373 exploitable remotely?
Yes, CVE-2022-28373 is exploitable remotely by attackers on the local network.