CVE-2022-26518
Published: 12 May 2022
Summary
CVE-2022-26518 is a high-severity OS Command Injection (CWE-78) vulnerability in Inhandnetworks Ir302 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 version V3.5.37. The flaw, tracked as CVE-2022-26518 and assigned CWE-78, allows a specially crafted series of network requests to trigger remote code execution on the affected device. It carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and low privileges required.
An authenticated attacker can send a sequence of requests to the device and obtain arbitrary command execution, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability is exploitable remotely without user interaction once low-privileged network access is obtained.
Vendor and researcher advisories are available at the referenced Talos Intelligence report and InHand Networks PSA-2022-01, which address the issue for the InRouter302 platform. The associated EPSS score has remained flat at 0.0689 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31076
Vulnerability details
An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.