PT-2022-6205 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-05-10 · Updated 2022-05-23 · CVE-2022-25995

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.4

Description A command execution vulnerability exists in the console inhand functionality, allowing an attacker to execute arbitrary commands by sending a specially-crafted network request. This vulnerability can be exploited remotely, potentially enabling an attacker to execute arbitrary code or commands.

Recommendations For InHand Networks InRouter302 version 3.5.4, consider restricting access to the console inhand functionality until a patch is available. As a temporary workaround, limit the ability to send specially-crafted network requests to the vulnerable device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2023-00473

CVE-2022-25995

Affected Products

Inrouter302

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1477 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25995 · Security Note
• https://inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25995 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00473 · Security Note