CVE-2022-28369
📋 TL;DR
This vulnerability allows remote attackers on the local network to execute arbitrary code as root on Verizon 5G Home LVSKIHP InDoorUnit devices. The device fails to validate user-supplied URLs in the SSH enable function, enabling attackers to write and execute malicious payloads. All users of affected Verizon 5G Home LVSKIHP InDoorUnit devices with vulnerable firmware are at risk.
💻 Affected Systems
- Verizon 5G Home LVSKIHP InDoorUnit (IDU)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root-level remote code execution, allowing attackers to intercept/modify all network traffic, install persistent backdoors, or use the device as a pivot point into the internal network.
Likely Case
Local network attackers gain full control of the device, enabling traffic interception, credential theft, and lateral movement to other devices on the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the device itself without allowing lateral movement to other critical systems.
🎯 Exploit Status
The vulnerability is well-documented with public proof-of-concept details. Exploitation requires only local network access and knowledge of the device IP address.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.verizon.com/info/reportsecurityvulnerability/
Restart Required: No
Instructions:
1. Contact Verizon support for firmware updates
2. Check for available firmware updates through the device management interface
3. Apply any available security patches immediately
🔧 Temporary Workarounds
Network Segmentation
allIsolate the Verizon 5G device on a separate VLAN to limit lateral movement
Access Control Lists
allImplement network ACLs to restrict access to the device's management interface
🧯 If You Can't Patch
- Segment the device on an isolated network VLAN with strict firewall rules
- Disable the crtcrpc JSON listener if possible through device configuration
🔍 How to Verify
Check if Vulnerable:
Check if device firmware version is 3.4.66.162 via device management interface or SSH if accessibleCheck Version:
Check device web interface or use: cat /etc/version (if SSH access available)Verify Fix Applied:
Verify firmware version has been updated to a version later than 3.4.66.162📡 Detection & Monitoring
Log Indicators:
- Unusual SSH connection attempts
- Unexpected writes to /usr/sbin/dropbear
- Suspicious network requests to crtcrpc JSON endpoint
Network Indicators:
- HTTP POST requests to device IP on unusual ports
- Unexpected outbound connections from the device
SIEM Query:
source="verizon-5g-device" AND (url="*crtcrpc*" OR path="/usr/sbin/dropbear")