CVE-2022-28369
- EPSS 1.08%
- Veröffentlicht 14.07.2022 13:15:08
- Zuletzt bearbeitet 21.11.2024 06:57:13
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the...
CVE-2022-28371
- EPSS 0.21%
- Veröffentlicht 14.07.2022 13:15:08
- Zuletzt bearbeitet 21.11.2024 06:57:14
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the...
CVE-2022-28372
- EPSS 0.25%
- Veröffentlicht 14.07.2022 13:15:08
- Zuletzt bearbeitet 21.11.2024 06:57:14
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is n...
CVE-2022-28373
- EPSS 4.39%
- Veröffentlicht 14.07.2022 13:15:08
- Zuletzt bearbeitet 21.11.2024 06:57:14
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inj...
CVE-2022-28377
- EPSS 0.29%
- Veröffentlicht 14.07.2022 13:15:08
- Zuletzt bearbeitet 21.11.2024 06:57:14
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the...