CVE-2022-26420

CVE-2022-26420 affects InHand Networks InRouter302 (V3.5.37). TALOS notes an OS command injection in the console infactory_port, where unvalidated input can be passed to system to execute arbitrary commands. The InRouter302 exposes a factory/console flow that allows constructing command strings (...

CVE-2022-26420: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the console infactoryport functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability...