Arbitrary File Upload Vulnerability in Verizon 5G Home Devices
CVE-2022-28372

7.5HIGH

Key Information:

Vendor

Verizon

Status
LvskiHP Indoorunit Firmware
Vendor
CVE Published:
14 July 2022

What is CVE-2022-28372?

The Verizon 5G Home InDoorUnit and OutDoorUnit devices have a security flaw that allows for arbitrary file uploads due to improper validation of firmware update URLs. This vulnerability arises in the provisioning process through the CRTC and ODU RPC endpoints, specifically in the functions handling firmware upgrades. Attackers can exploit the unjustified upload capability, potentially leading to unauthorized code execution or other malicious actions on the devices. Ensuring proper validation of firmware source URLs is critical to preventing such vulnerabilities.

References

https://www.verizon.com/info/reportsecurityvulnerability/
x_refsource_MISC
https://github.com/JousterL/SecWriteups/blob/main/Verizon...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.