On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
References
Link | Resource |
---|---|
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md | Exploit Third Party Advisory |
https://www.verizon.com/info/reportsecurityvulnerability/ | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-07-14T12:29:06
Updated: 2022-07-14T12:29:06
Reserved: 2022-04-03T00:00:00
Link: CVE-2022-28371
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-07-14T13:15:08.317
Modified: 2023-08-08T14:21:49.707
Link: CVE-2022-28371
JSON object: View
Redhat Information
No data.
CWE