[SECURITY] Fedora 36 Update: golang-github-twitchtv-twirp-8.1.0-5.fc36

A simple RPC framework with protobuf service definitions...

Microsoft Patch Tuesday July 2022: propaganda report, CSRSS EoP, RPC RCE, Edge, Azure Site Recovery

Hello everyone! Microsoft has been acting weird lately. I mean the recent publication of a propaganda report about evil Russians and how Microsoft is involved in the conflict between countries. It wouldnt be unusual for a US government agency, NSA or CIA to publish such a report. But when a globa...

CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication. Recent assessments: gwillcox-r7 at October 25, 2022 5:15pm UTC reported: This was...

[SECURITY] Fedora 35 Update: golang-github-twitchtv-twirp-8.1.0-4.fc35

A simple RPC framework with protobuf service definitions...

SUSE SLED15 / SLES15 Security Update : p11-kit (SUSE-SU-2022:2405-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2405-1 advisory. - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the R...

CVE-2022-28371

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download...

Default credentials

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of th...

Input validation

On Verizon 5G Home LVSKIHP OutDoorUnit ODU 3.33.101.0 devices, the RPC endpoint crtcfwupgrade provides a means of provisioning a firmware update for the device. /lib/functions/wncjsonsh/wnccrtcfw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed...

Design/Logic Flaw

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download...

CVE-2022-28370

CVE-2022-28370 affects Verizon 5G Home LVSKIHP Outdoor Unit (ODU) version 3.33.101.0. The vulnerability is in the RPC endpoint crtc_fw_upgrade used for provisioning firmware updates, where the script /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh performs no cryptographic validation of the firmware ima...

CVE-2022-28372

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtcfwupgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file uplo...

CVE-2022-28372

The CVE-2022-28372 entry describes a vulnerability in Verizon 5G Home LVSKIHP devices (IDU 3.4.66.162 and ODU 3.33.101.0). The CRTC and ODU RPC endpoints allow provisioning a firmware update via crtc_fw_upgrade or crtcfwimage; the provided URL is not validated, enabling arbitrary file upload to t...

PT-2022-18981

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description The CRTC and ODU RPC endpoints in the affected devices provide a means of provisioning a firmware update via crtc ...

CVE-2022-28371: Use of Hard-coded Credentials

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download...

PT-2022-18980 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description: The CRTC and ODU RPC endpoints rely on a static certificate for access control, which is embedded in the firmwar...

PT-2022-18986

Name of the Vulnerable Software and Affected Versions Verizon 5G Home LVSKIHP InDoorUnit IDU version 3.4.66.162 Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description The issue concerns the use of a static account username and password for access control on the CRTC and ODU RPC...

CVE-2022-22038

CVE-2022-22038 is a Remote Procedure Call Runtime Remote Code Execution vulnerability. Connected sources note a POC exploit exists and that exploitation would require multiple attempts with high attack complexity, potentially over a network. The available documents do not specify affected product...

CVE-2022-22038 Remote Procedure Call Runtime Remote Code Execution Vulnerability

...

CVE-2022-35411

rpc.py CVE-2022-35411 allows unauthenticated RCE via HTTP header serializer: pickle, triggering Python pickle deserialization in rpc.py up to v0.6.0. Affected versions are cited as v0.4.2–v0.6.0; exploits and demonstrations exist (e.g., PacketsStorm, Exploit-DB). Public exploitation code targets ...

rpc.py code issue vulnerabilities

rpc.py is a fast and powerful ASGI/WSGI-based RPC framework for individual developers in Aber, China. A security vulnerability exists in rpc.py version 0.6.0 and earlier. An attacker exploited the vulnerability to process data using unpickle...