CVE-2022-28376: High severity verizon lvskihp vulnerability
Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28376?
CVE-2022-28376 has a high severity due to its potential for unauthorized access to administrative features on Verizon 5G Home devices.
How do I fix CVE-2022-28376?
To fix CVE-2022-28376, you should update the firmware to a version released after February 15, 2022, provided by Verizon.
What devices are affected by CVE-2022-28376?
CVE-2022-28376 affects Verizon 5G Home devices running firmware versions up to and including 2022-02-15.
What are the risks associated with CVE-2022-28376?
The risks associated with CVE-2022-28376 include unauthorized access to the device's admin interface, which could lead to configuration changes or network compromise.
Is there a known exploit for CVE-2022-28376?
Yes, CVE-2022-28376 is exploitable by anyone who knows the device's serial number, allowing access to the admin website.