CVE-2022-28375
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root,
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2022-07-14
- Last modified
- 2024-08-03
- Weaknesses
- CWE-78
Affected products
References
- https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
- https://www.verizon.com/info/reportsecurityvulnerability/
