PT-2022-6206 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-05-10 · Updated 2022-05-23 · CVE-2022-26510

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.37

Description The issue is related to the incorrect verification of the cryptographic signature in the firmware update procedure of the InHand Networks InRouter302. This can be exploited by a remote attacker using a specially crafted HTTP request to update the firmware. An attacker can trigger this issue by sending a sequence of requests.

Recommendations For InHand Networks InRouter302 version 3.5.37, consider restricting access to the firmware update functionality until a patch is available. As a temporary workaround, avoid using the vulnerable firmware update mechanism. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2023-00474

CVE-2022-26510

Affected Products

Inrouter302

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1495 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26510 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26510 · Vendor Advisory
• https://inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00474 · Security Note
• https://t.me/cibsecurity/42517 · Telegram Post