PT-2022-17111 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-05-12 · Updated 2023-06-23 · CVE-2022-25172

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.4

Description An information disclosure issue exists in the web interface session cookie functionality. The session cookie lacks the HttpOnly flag, making it accessible via JavaScript. This allows an attacker who can perform a cross-site scripting (XSS) attack to steal the session cookie.

Recommendations For InHand Networks InRouter302 version 3.5.4, consider setting the HttpOnly flag for the session cookie to prevent it from being accessed via JavaScript as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-1004

Related Identifiers

CVE-2022-25172

Affected Products

Inrouter302

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1470 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25172 · Security Note
• https://inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25172 · Vendor Advisory