https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-28377.htmlhttps://patchthecve.com/cve/CVE-2022-28377.htmlWed, 17 Jun 2026 04:38:27 +0000HIGH 7.5: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of thttps://patchthecve.com/cve/CVE-2022-28375.htmlhttps://patchthecve.com/cve/CVE-2022-28375.htmlWed, 17 Jun 2026 04:38:27 +0000CRITICAL 9.8: Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achttps://patchthecve.com/cve/CVE-2022-28374.htmlhttps://patchthecve.com/cve/CVE-2022-28374.htmlWed, 17 Jun 2026 04:38:27 +0000HIGH 8.8: Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controllerhttps://patchthecve.com/cve/CVE-2022-28373.htmlhttps://patchthecve.com/cve/CVE-2022-28373.htmlWed, 17 Jun 2026 04:38:27 +0000CRITICAL 9.8: Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code exhttps://patchthecve.com/cve/CVE-2022-28372.htmlhttps://patchthecve.com/cve/CVE-2022-28372.htmlWed, 17 Jun 2026 04:38:26 +0000HIGH 7.5: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file uhttps://patchthecve.com/cve/CVE-2022-28371.htmlhttps://patchthecve.com/cve/CVE-2022-28371.htmlWed, 17 Jun 2026 04:38:26 +0000HIGH 7.5: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download https://patchthecve.com/cve/CVE-2022-28370.htmlhttps://patchthecve.com/cve/CVE-2022-28370.htmlWed, 17 Jun 2026 04:38:26 +0000HIGH 7.5: On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installehttps://patchthecve.com/cve/CVE-2022-28369.htmlhttps://patchthecve.com/cve/CVE-2022-28369.htmlWed, 17 Jun 2026 04:38:26 +0000CRITICAL 9.8: Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The dahttps://patchthecve.com/cve/CVE-2022-29729.htmlhttps://patchthecve.com/cve/CVE-2022-29729.htmlWed, 17 Jun 2026 04:40:39 +0000HIGH 7.5: Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.https://patchthecve.com/cve/CVE-2022-28376.htmlhttps://patchthecve.com/cve/CVE-2022-28376.htmlWed, 17 Jun 2026 04:38:27 +0000HIGH 8.1: Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP stri