CVE-2022-26420
Published: 12 May 2022
Summary
CVE-2022-26420 is a high-severity OS Command Injection (CWE-78) vulnerability in Inhandnetworks Ir302 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-26420 is an OS command injection vulnerability, tracked as CWE-78, that affects the console infactory_port functionality of InHand Networks InRouter302 running firmware version 3.5.37. A specially crafted series of network requests can trigger remote code execution on the device.
An attacker with low privileges and network access can exploit the flaw without user interaction, achieving arbitrary command execution that impacts confidentiality, integrity, and availability. The vulnerability carries a CVSS 3.1 base score of 8.8 under vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Public advisories from Cisco Talos (TALOS-2022-1499) and InHand Networks (PSA-2022-01) provide further details on the issue and recommended actions.
The EPSS score for this CVE has remained flat at a peak value of 0.0906.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30979
Vulnerability details
An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.