PT-2022-3464 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-05-12 · Updated 2022-05-23 · CVE-2022-27172

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.37

Description The issue is related to the use of hardcoded credentials in the InHand Networks InRouter302, specifically in the console infactory functionality. This can be exploited by a remote attacker to execute arbitrary actions. A specially-crafted network request can lead to privileged operation execution, allowing an attacker to send a sequence of requests to trigger the vulnerability.

Recommendations For InHand Networks InRouter302 version 3.5.37, consider changing the hardcoded password in the console infactory functionality to prevent exploitation. As a temporary workaround, restrict access to the console infactory functionality until a patch is available. Avoid using the default credentials for the console infactory functionality to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

BDU:2022-04242

CVE-2022-27172

Affected Products

Inrouter302

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1496 · Exploit
• https://inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27172 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27172 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04242 · Security Note
• https://t.me/cibsecurity/42532 · Telegram Post