Lvskihp Outdoorunit Firmware vulnerabilities
6 known vulnerabilities in Lvskihp Outdoorunit Firmware from Verizon. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Lvskihp Indoorunit Firmware: Weak Password Requirements
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware,
- 9.8 Critical severity
Lvskihp Outdoorunit Firmware: Improper Neutralization of Special Elements used in an OS Command
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/l
- 8.8 High severity
Lvskihp Outdoorunit Firmware: Improper Neutralization of Special Elements used in an OS Command
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacte
- 7.5 High severity
Lvskihp Indoorunit Firmware: Unrestricted Upload of File with Dangerous Type
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validat
- 7.5 High severity
Lvskihp Indoorunit Firmware: Use of Hard-coded Credentials
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of
- 7.5 High severity
Lvskihp Outdoorunit Firmware: Insufficient Verification of Data Authenticity
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus all