CVE-2022-28377

Katalog CVE

CVSS 7.5 · High EPSS 0,97%

Kerentanan Weak Password Requirements pada verizon lvskihp indoorunit firmware, verizon lvskihp outdoorunit firmware. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU).

Rincian

Terbit di NVD

14 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-521: Weak Password Requirements

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 60,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.verizon.com/info/reportsecurityvulnerability/ advisory vendor
• https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md exploit · advisory pihak ketiga