PT-2022-18344 · Inhand Networks · Inrouter 900

Published 2022-04-10 · Updated 2023-08-08 · CVE-2022-27270

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter 900 Industrial 4G Router versions prior to 1.0.0.r11700

Description A remote code execution issue was discovered in the ipsec secrets component. This issue can be triggered by a crafted packet, potentially allowing for remote code execution.

Recommendations For versions prior to 1.0.0.r11700, update to version 1.0.0.r11700 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-27270

Affected Products

Inrouter 900

References · 5

• 🔥 https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities(RCE).pdf · Exploit
• 🔥 https://drive.google.com/drive/folders/1zJ2dGrKar-WTlYz13v1f0BIsoIm3aU0l?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-27270 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27270 · Vendor Advisory
• https://github.com/wu610777031/IoT_Hunter/blob/main/Inhand%20InRouter%20900%20Industrial%204G%20Router%20%20Vulnerabilities%28RCE%29.pdf · Note