CVE-2022-28371

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md	Exploit Third Party Advisory
https://www.verizon.com/info/reportsecurityvulnerability/	Vendor Advisory
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md	Exploit Third Party Advisory
https://www.verizon.com/info/reportsecurityvulnerability/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:verizon:lvskihp_indoorunit_firmware:3.4.66.162:*:*:*:*:*:*:*

cpe:2.3:h:verizon:lvskihp_indoorunit:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:*

cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-07-14 13:15

Updated : 2024-11-21 06:57

NVD link : CVE-2022-28371

Mitre link : CVE-2022-28371

CVE.ORG link : CVE-2022-28371

JSON object : View

Products Affected

verizon

lvskihp_indoorunit
lvskihp_indoorunit_firmware
lvskihp_outdoorunit_firmware
lvskihp_outdoorunit

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2022-28371", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-14T13:15:08.317", "references": [{"url": "https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.verizon.com/info/reportsecurityvulnerability/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.verizon.com/info/reportsecurityvulnerability/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)"}, {"lang": "es", "value": "En los dispositivos InDoorUnit (IDU) versi\u00f3n 3.4.66.162 y OutDoorUnit (ODU) versi\u00f3n 3.33.101.0 de Verizon 5G Home LVSKIHP, los endpoints RPC de CRTC y ODU dependen de un certificado est\u00e1tico para el control de acceso. Este certificado est\u00e1 integrado en el firmware y es id\u00e9ntico en toda la flota de dispositivos. Un atacante s\u00f3lo necesita descargar este firmware y extraer los componentes privados de estos certificados (de /etc/lighttpd.d/ca.pem y /etc/lighttpd.d/server.pem) para conseguir acceso. (La ubicaci\u00f3n de la descarga del firmware es mostrada en los registros de actualizaci\u00f3n del dispositivo)"}], "lastModified": "2024-11-21T06:57:14.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:verizon:lvskihp_indoorunit_firmware:3.4.66.162:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9D9319E-5FB5-442A-89B0-3559210B7250"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:verizon:lvskihp_indoorunit:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6A0557F4-75F3-4DF4-8F95-CC9F9239D243"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "569F1902-F20B-4E2A-9BED-FF25E15535E9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C2E2257C-8E43-4910-93FF-70CC51430D96"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}