Lucene search
PRIOn knowledge basePRION:CVE-2023-22598HistoryJan 12, 2023 - 11:15 p.m.
Command injection
2023-01-1223:15:00
PRIOn knowledge base
www.prio-n.com
7
inhand networks
inrouter 302
inrouter 615
command injection
vulnerability
cwe-78
improper neutralization
os command injection
unauthorized user
privileged access
local web interface
cloud account
configuration update
root access
remote code execution
root privileges
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’). An unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices could push a specially crafted configuration update file to gain root access. This could lead to remote code execution with root privileges.
| CPE | Name | Operator | Version |
|---|---|---|---|
| inrouter302_firmware | lt | 3.5.56 | |
| inrouter615-s_firmware | eq | < 2.3.0.r5542 |
Related
cvelist
cvelist
CVE-2023-22598
2023-01-12 22:30:33
cve
cve
CVE-2023-22598
2023-01-12 23:15:10
nvd
nvd
CVE-2023-22598
2023-01-12 23:15:10
ics
ics
InHand Networks InRouter
2023-01-13 12:00:00
thn
thn