Vulnerability in Verizon Lvskihp Indoorunit
CVE-2022-28371
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (44.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Verizon Lvskihp Indoorunit
- Verizon Lvskihp Indoorunit Firmware — versions 3.4.66.162
- Verizon Lvskihp Outdoorunit
- Verizon Lvskihp Outdoorunit Firmware — versions 3.33.101.0
Weakness classification (CWE)
References
- www.verizon.com/info/reportsecurityvulnerability/ (Vendor Advisory)
- github.com/JousterL/SecWriteups/blob/main/Verizon LVSKIHP 5G Modem/readme.md (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-28371?
- CVE-2022-28371 is a high-severity vulnerability in Verizon Lvskihp Indoorunit, classified under Use of Hard-coded Credentials. CVSS score: 7.5/10. Published 2022-07-14.
- How severe is CVE-2022-28371?
- High severity. CVSS v3 base score is 7.5 out of 10.