Lucene search
PRIOn knowledge basePRION:CVE-2022-28369HistoryJul 14, 2022 - 1:15 p.m.
Code injection
2022-07-1413:15:00
PRIOn knowledge base
www.prio-n.com
4
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function’s enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root.
| CPE | Name | Operator | Version |
|---|---|---|---|
| lvskihp_indoorunit_firmware | eq | 3.4.66.162 |
Related
cve
cve
CVE-2022-28369
2022-07-14 13:15:08
nvd
nvd
CVE-2022-28369
2022-07-14 13:15:08
cvelist
cvelist
CVE-2022-28369
2022-07-14 12:29:24