CVE-2022-28377: High severity verizon lvskihp vulnerability
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICEMANUFACTURER='WistronNeWebCorp.' to /etc/deviceinfo to replicate the host environment. This occurs in /etc/init.d/wncfactoryssidkeypwd (IDU).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28377?
CVE-2022-28377 is considered a moderate severity vulnerability due to its reliance on static credentials for access control.
How do I fix CVE-2022-28377?
To mitigate CVE-2022-28377, update the firmware of your Verizon 5G Home devices to the latest version with improved security features.
Which devices are affected by CVE-2022-28377?
CVE-2022-28377 affects the Verizon 5G Home LVSKIHP IndoorUnit firmware version 3.4.66.162 and OutdoorUnit firmware version 3.33.101.0.
What are the implications of exploiting CVE-2022-28377?
Exploiting CVE-2022-28377 allows unauthorized access to the device through weak authentication mechanisms.
Is there a patch available for CVE-2022-28377?
Yes, a patch is available through firmware updates for the affected Verizon 5G Home devices.