CVE-2022-28375

Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root,

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md	Exploit Third Party Advisory
https://www.verizon.com/info/reportsecurityvulnerability/	Vendor Advisory
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md	Exploit Third Party Advisory
https://www.verizon.com/info/reportsecurityvulnerability/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:*

cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:57

Type	Values Removed	Values Added
References	~~() https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md - Exploit, Third Party Advisory~~	() https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md - Exploit, Third Party Advisory
References	~~() https://www.verizon.com/info/reportsecurityvulnerability/ - Vendor Advisory~~	() https://www.verizon.com/info/reportsecurityvulnerability/ - Vendor Advisory

08 Aug 2023, 14:21

Type	Values Removed	Values Added
CWE	~~CWE-116~~	CWE-78

Information

Published : 2022-07-14 13:15

Updated : 2024-11-21 06:57

NVD link : CVE-2022-28375

Mitre link : CVE-2022-28375

CVE.ORG link : CVE-2022-28375

JSON object : View

Products Affected

verizon

lvskihp_outdoorunit
lvskihp_outdoorunit_firmware

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2022-28375", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-07-14T13:15:08.480", "references": [{"url": "https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.verizon.com/info/reportsecurityvulnerability/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.verizon.com/info/reportsecurityvulnerability/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root,"}, {"lang": "es", "value": "Verizon 5G Home LVSKIHP OutDoorUnit (ODU) versi\u00f3n 3.33.101.0, no sanea apropiadamente los par\u00e1metros controlados por el usuario dentro de la funci\u00f3n crtcswitchsimprofile del listener JSON de crtcrpc. Un atacante remoto en la red local puede inyectar meta caracteres de shell en el archivo /usr/lib/lua/5.1/luci/controller/rpc.lua para lograr una ejecuci\u00f3n de c\u00f3digo remota como root"}], "lastModified": "2024-11-21T06:57:14.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "569F1902-F20B-4E2A-9BED-FF25E15535E9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C2E2257C-8E43-4910-93FF-70CC51430D96"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}