CVE-2022-26042

An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26042

InRouter302 (InHand) with firmware 3.5.4 has an OS command-injection in the daretools binary. TALOS-2022-1478 shows the HTTP server and a debug inhand function enabling a user with a hard-coded password to run the daretools binary, which then accepts lines; if a line starts with a or r, it calls ...