Remote Code Execution Vulnerability in Verizon 5G Home Outdoor Unit
CVE-2022-28375

9.8CRITICAL

Key Information:

Vendor

Verizon

Status
LvskiHP Outdoorunit Firmware
Vendor
CVE Published:
14 July 2022

What is CVE-2022-28375?

The Verizon 5G Home LVSKIHP Outdoor Unit (ODU) version 3.33.101.0 has a severe vulnerability due to improper sanitization of user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. This flaw enables a remote attacker on the local network to inject shell metacharacters into the rpc.lua script located at /usr/lib/lua/5.1/luci/controller/. Successful exploitation of this vulnerability can lead to remote code execution with root privileges, potentially compromising the integrity and security of the affected device.

References

https://www.verizon.com/info/reportsecurityvulnerability/
x_refsource_MISC
https://github.com/JousterL/SecWriteups/blob/main/Verizon...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.