PT-2022-19169 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-10-28 · Updated 2022-11-10 · CVE-2022-28689

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.45

Description A leftover debug code vulnerability exists in the console support functionality. This vulnerability can be triggered by a specially-crafted network request, leading to arbitrary command execution. An attacker can exploit this issue by sending a sequence of requests.

Recommendations For InHand Networks InRouter302 version 3.5.45, consider disabling the console support functionality until a patch is available to prevent arbitrary command execution. Restrict access to the network to minimize the risk of exploitation. Avoid using the vulnerable console support functionality in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-489

Related Identifiers

CVE-2022-28689

Affected Products

Inrouter302

References · 6

• https://osv.dev/vulnerability/CVE-2022-28689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28689 · Security Note
• https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf · Vendor Advisory
• https://t.me/cibsecurity/52715 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1521 · Note
• https://t.me/true_secator/3632 · Telegram Post