CVE-2022-28373

Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code...

CVE-2022-28377

On Verizon 5G Home LVSKIHP InDoorUnit IDU 3.4.66.162 and OutDoorUnit ODU 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of th...

PT-2022-18983 · Verizon · Verizon 5G Home Lvskihp Outdoorunit

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP OutDoorUnit ODU version 3.33.101.0 Description: The issue concerns the lack of proper sanitization of user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. This allows an...

CVE-2022-28376

Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone knowing the device's serial number to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password for the verizon username is calculated by concatenating the serial number and the model i.e., the LVSKIHP string...

PT-2022-18985 · Verizon · Verizon 5G Home

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP outside devices through 2022-02-15 Description: The issue allows anyone with knowledge of the device's serial number to access a CPE admin website, for example, at the "10.0.0.1" IP address. The password for the verizo...