CVE-2022-26075
Published: 12 May 2022
Summary
CVE-2022-26075 is a high-severity OS Command Injection (CWE-78) vulnerability in Inhandnetworks Ir302 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An OS command injection vulnerability, tracked as CVE-2022-26075 and assigned CWE-78, affects the console infactory_wlan functionality of InHand Networks InRouter302 running firmware version V3.5.37. The flaw permits remote code execution when an attacker supplies a specially crafted series of network requests, and it carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, and low privileges required.
An authenticated attacker positioned on the network can send the malicious request sequence to the device and obtain arbitrary command execution, resulting in full compromise of confidentiality, integrity, and availability without any user interaction.
Public advisories from Talos Intelligence (TALOS-2022-1500) and InHand Networks (InHand-PSA-2022-01) provide additional technical detail and remediation guidance for affected deployments. The associated EPSS score has remained flat at 0.0906 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30643
Vulnerability details
An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.