Lucene search

[email protected]NVD:CVE-2022-28370

HistoryJul 14, 2022 - 1:15 p.m.

CVE-2022-28370

2022-07-1413:15:08

CWE-345

[email protected]

web.nvd.nist.gov

verizon

firmware

update

vulnerability

cryptographic

validation

image

attacker

modify

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

37.9%

JSON

On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed firmware.

Affected configurations

Nvd

Node

verizonlvskihp_outdoorunit_firmwareMatch3.33.101.0

AND

verizonlvskihp_outdoorunitMatch-

VendorProductVersionCPE
verizonlvskihp_outdoorunit_firmware3.33.101.0cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:*
verizonlvskihp_outdoorunit-cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
verizon	lvskihp_outdoorunit_firmware	3.33.101.0	cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:::::::*
verizon	lvskihp_outdoorunit	-	cpe:2.3:h:verizon:lvskihp_outdoorunit:-:::::::*

References

github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md

www.verizon.com/info/reportsecurityvulnerability/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

37.9%

JSON

Related for NVD:CVE-2022-28370

cvelist1 cve1 prion1