Authentication Bypass in Verizon 5G Home Devices

CVE-2022-28376

What is CVE-2022-28376?

The Verizon 5G Home LVSKIHP devices are susceptible to unauthorized access due to a flaw in their authentication process. An attacker can exploit the vulnerability by simply knowing the device's serial number to gain access to the CPE administration web interface, typically located at the 10.0.0.1 IP address. The password for the administrator account is generated using a predictable method, which combines the device's serial number with the model identifier. This weakness allows the extraction of the first and last seven characters of the SHA-256 hash of the concatenated string, posing a significant threat to device security and user data confidentiality.

References