CVE-2022-28374

8.8 highEPSS 2.4%

High (8.8) in verizon lvskihp outdoorunit firmware. EPSS 2.4% chance of exploitation in the next 30 days.

Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/admin/settings.lua to achieve remote code execution as root.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-07-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

verizon:lvskihp_outdoorunit_firmware

References

https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
https://www.verizon.com/info/reportsecurityvulnerability/
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
https://www.verizon.com/info/reportsecurityvulnerability/

Check your stack JSON