CVE-2022-28370: Insufficient Verification of Data Authenticity

On Verizon 5G Home LVSKIHP OutDoorUnit ODU 3.33.101.0 devices, the RPC endpoint crtcfwupgrade provides a means of provisioning a firmware update for the device. /lib/functions/wncjsonsh/wnccrtcfw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed...

PT-2018-7247

Name of the Vulnerable Software and Affected Versions: GIGABYTE BRIX UEFI firmware affected versions not specified Description: The issue concerns the lack of cryptographic validation of images prior to updating the system firmware. Furthermore, firmware updates are served over HTTP, which allows...