Lucene search

TalosCVE-2022-21809

HistoryMay 12, 2022 - 5:15 p.m.

CVE-2022-21809

2022-05-1217:15:10

CWE-377

CWE-434

talos

web.nvd.nist.gov

cve-2022-21809

file write vulnerability

inhand networks

inrouter302

arbitrary file upload

http

security vulnerability

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.

Affected configurations

Nvd

Vulners

Node

inhandnetworksinrouter302_firmwareRange≤3.5.37

AND

inhandnetworksinrouter302Match-

VendorProductVersionCPE
inhandnetworksinrouter302_firmware*cpe:2.3:o:inhandnetworks:inrouter302_firmware:*:*:*:*:*:*:*:*
inhandnetworksinrouter302-cpe:2.3:h:inhandnetworks:inrouter302:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
inhandnetworks	inrouter302_firmware	*	cpe:2.3:o:inhandnetworks:inrouter302_firmware::::::::
inhandnetworks	inrouter302	-	cpe:2.3:h:inhandnetworks:inrouter302:-:::::::*

CNA Affected

[
  {
    "product": "InRouter302",
    "vendor": "InHand Networks",
    "versions": [
      {
        "status": "affected",
        "version": "V3.5.4"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2022-1468

www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf

Social References

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

Related for CVE-2022-21809