CVE-2022-28375
📋 TL;DR
This vulnerability allows remote attackers on the local network to execute arbitrary commands as root on Verizon 5G Home LVSKIHP outdoor units. The issue stems from improper input sanitization in the crtcswitchsimprofile function, enabling shell injection. All users of affected Verizon 5G Home equipment are at risk.
💻 Affected Systems
- Verizon 5G Home LVSKIHP OutDoorUnit (ODU)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the device with root access, allowing attackers to intercept/modify network traffic, install persistent malware, pivot to other network devices, or disable the internet connection entirely.
Likely Case
Attackers on the local network gain full control of the 5G modem/router, enabling them to monitor all traffic, steal credentials, and potentially attack other devices on the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the device itself without lateral movement to other systems.
🎯 Exploit Status
Public exploit details available in GitHub repository. Exploitation requires only network access and knowledge of the device's IP address.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.verizon.com/info/reportsecurityvulnerability/
Restart Required: Yes
Instructions:
1. Contact Verizon support for firmware updates. 2. Check for automatic firmware updates from Verizon. 3. If update available, apply through device admin interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the Verizon 5G device on its own VLAN to limit attack surface
Access Control Lists
linuxImplement firewall rules to restrict access to the device's management interface
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Physically isolate the device from untrusted networks
- Monitor network traffic for unusual RPC requests to the device
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in admin interface. If version is 3.33.101.0, device is vulnerable.Check Version:
curl -s http://[device-ip]/cgi-bin/luci/rpc/Sys?auth=[token]&method=exec¶ms='cat /etc/version'Verify Fix Applied:
Verify firmware version has changed from 3.33.101.0 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual Lua/RPC process execution
- Shell commands originating from network requests
- Failed authentication attempts to RPC interface
Network Indicators:
- HTTP POST requests to /cgi-bin/luci/rpc containing shell metacharacters
- Unusual outbound connections from the Verizon device
SIEM Query:
source="verizon-router" AND (url="/cgi-bin/luci/rpc" AND (body="exec" OR body="system" OR body="os.execute"))