Cyber Resilience

CVE-2022-26518

HighPublic PoCRCE

Published: 12 May 2022

Published
12 May 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0689 91.6th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26518 is a high-severity OS Command Injection (CWE-78) vulnerability in Inhandnetworks Ir302 Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 version V3.5.37. The flaw, tracked as CVE-2022-26518 and assigned CWE-78, allows a specially crafted series of network requests to trigger remote code execution on the affected device. It carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and low privileges required.

An authenticated attacker can send a sequence of requests to the device and obtain arbitrary command execution, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability is exploitable remotely without user interaction once low-privileged network access is obtained.

Vendor and researcher advisories are available at the referenced Talos Intelligence report and InHand Networks PSA-2022-01, which address the issue for the InRouter302 platform. The associated EPSS score has remained flat at 0.0689 with no material increase since disclosure.

EU & UK References

Vulnerability details

An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

inhandnetworks
ir302 firmware
3.5.37

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References