High severity7.5NVD Advisory· Published Jul 14, 2022· Updated Jun 17, 2026
CVE-2022-28371
CVE-2022-28371
Description
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Verizon 5G Home/LVSKIHP InDoorUnitdescription
- Range: IDU 3.4.66.162, ODU 3.33.101.0
Patches
Vulnerability mechanics
References
2- github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.mdnvdExploitThird Party Advisory
- www.verizon.com/info/reportsecurityvulnerability/nvdVendor Advisory
News mentions
0No linked articles in our index yet.