Lucene search

TalosCVE-2022-26782

HistoryMay 12, 2022 - 5:15 p.m.

CVE-2022-26782

2022-05-1217:15:11

CWE-787

CWE-20

talos

web.nvd.nist.gov

cve

inhand networks

inrouter302

v3.5.4

input validation

remote code execution

http

vulnerability

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.005

Percentile

77.6%

JSON

Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input validation vulnerability exists in the httpd’s user_define_set_item function. Controlling the user_define_timeout nvram variable can lead to remote code execution.

Affected configurations

Nvd

Vulners

Node

inhandnetworksir302_firmwareRange≤3.5.37

AND

inhandnetworksir302Match-

VendorProductVersionCPE
inhandnetworksir302_firmware*cpe:2.3:o:inhandnetworks:ir302_firmware:*:*:*:*:*:*:*:*
inhandnetworksir302-cpe:2.3:h:inhandnetworks:ir302:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
inhandnetworks	ir302_firmware	*	cpe:2.3:o:inhandnetworks:ir302_firmware::::::::
inhandnetworks	ir302	-	cpe:2.3:h:inhandnetworks:ir302:-:::::::*

CNA Affected

[
  {
    "product": "InRouter302",
    "vendor": "InHand Networks",
    "versions": [
      {
        "status": "affected",
        "version": "V3.5.4"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2022-1481

www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.005

Percentile

77.6%

JSON

Related for CVE-2022-26782