CVE-2022-28373
📋 TL;DR
This vulnerability allows remote attackers on the local network to execute arbitrary commands as root on Verizon 5G Home LVSKIHP InDoorUnit devices. The issue stems from improper input sanitization in the crtcrpc JSON listener, enabling shell injection attacks. Only users of specific Verizon 5G modem hardware with vulnerable firmware are affected.
💻 Affected Systems
- Verizon 5G Home LVSKIHP InDoorUnit (IDU)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root-level remote code execution, allowing attackers to intercept/modify network traffic, install persistent malware, or pivot to other network devices.
Likely Case
Local network attacker gains full control of the modem/router, enabling traffic monitoring, credential theft, and network reconnaissance.
If Mitigated
If network segmentation isolates the device and restricts local network access, impact is limited to denial of service or configuration changes.
🎯 Exploit Status
Public exploit details available in GitHub repository; exploitation requires only network access and knowledge of the target IP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.verizon.com/info/reportsecurityvulnerability/
Restart Required: No
Instructions:
Contact Verizon support for firmware updates; check for available updates through the device web interface or mobile app.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the modem/router on a separate VLAN to limit lateral movement from compromised devices.
Access Control Lists
allImplement firewall rules to restrict access to the modem's management interface (typically port 80/443) to trusted management hosts only.
🧯 If You Can't Patch
- Replace vulnerable hardware with a different model or manufacturer
- Disable remote management features and use wired connections only
🔍 How to Verify
Check if Vulnerable:
Check firmware version in device web interface (typically at http://192.168.0.1 or http://192.168.1.1) under Settings > About or System Information.Check Version:
curl -s http://192.168.0.1/cgi-bin/luci/ | grep -i versionVerify Fix Applied:
Verify firmware version has been updated to a version later than 3.4.66.162 through the device web interface.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/luci paths
- Shell command execution in system logs
- Unexpected process creation as root
Network Indicators:
- Unusual outbound connections from modem IP
- Traffic to/from modem on non-standard ports
- HTTP requests with shell metacharacters in parameters
SIEM Query:
source="modem_logs" AND (url="*crtcrpc*" OR cmd="*sh*" OR user="root")