CVE-2022-28373

The CVE-2022-28373 entry concerns Verizon 5G Home LVSKIHP InDoorUnit (IDU) version 3.4.66.162. The vulnerability exists in the crtcreadpartition function of the crtcrpc JSON listener located at /usr/lib/lua/luci/crtc.lua, where user-controlled parameters are not properly sanitized. A remote attac...

CVE-2022-28377

Affected: Verizon 5G Home LVSKIHP IDU 3.4.66.162 and ODU 3.33.101.0. Root cause: CRTC/ODU RPC endpoints rely on a static account username/password for access control, and the password can be generated via a firmware binary after determining the IDU’s base Ethernet MAC and setting DEVICE_MANUFACTU...

PT-2022-18980 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description: The CRTC and ODU RPC endpoints rely on a static certificate for access control, which is embedded in the firmwar...

PT-2022-18978

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Description The issue concerns the failure to validate user-provided URLs within the crtcmode function's enable ssh sub-operation of the crtcrpc JSON listener, located at...

CVE-2022-28371: Use of Hard-coded Credentials

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download...

CVE-2022-28369: Unrestricted Upload of File with Dangerous Type

Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enablessh sub-operation of the crtcrpc JSON listener found at /lib/functions/wncjsonsh/crtcmode.sh A remote attacker on the local network can provide a malicious URL. The data...

Verizon 5G Home LVSKIHP 操作系统命令注入漏洞

The Verizon 5G Home LVSKIHP is an all-in-one integrated modem and router from Verizon USA. It provides access to Verizon Wireless 5G wireless home Internet services. A security vulnerability exists in Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162, which stems from not properly handlin...

CVE-2021-44617: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated...

GLPI SQL注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2009-0324

CVE-2009-0324 describes multiple SQL injection vulnerabilities in BibCiter 1.4. The affected components are the PHP scripts reports/projects.php (parameter idp), reports/contacts.php (parameter idc), and reports/users.php (parameter idu). The root cause is unsanitized input leading to arbitrary S...