PT-2022-6207 · Inhand Networks · Inrouter302

Francesco Benvenuto · Published 2022-05-10 · Updated 2022-05-23 · CVE-2022-24910

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter302 version 3.5.4

Description A buffer overflow vulnerability exists in the httpd parse ping result API functionality. This issue is related to copying a buffer without checking the size of the input data, which can be exploited by sending a specially-crafted file or a sequence of requests, potentially leading to remote code execution.

Recommendations For InHand Networks InRouter302 version 3.5.4, consider disabling the parse ping result API functionality as a temporary workaround until a patch is available. Restrict access to the httpd functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-00475

CVE-2022-24910

Affected Products

Inrouter302

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1471 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24910 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24910 · Vendor Advisory
• https://inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00475 · Security Note
• https://t.me/cibsecurity/42523 · Telegram Post