Login Request a demo
High severity · published Jan 12, 2023
CVE-2023-22598
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization…
7.2
CVSS
1.7%
EPSS
No
On KEV
Description
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices could push a specially crafted configuration update file to gain root access. This could lead to remote code execution with root privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Inrouter302 Firmware · Inhandnetworks
before 3.5.56 · source: NVD
IF
Inrouter615-s Firmware · Inhandnetworks
before 2.3.0.r5542 · source: NVD
Affected product
IF
Inrouter302 Firmware
Inhandnetworks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22598
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03
More from Inrouter302 Firmware
9.8
CVE-2022-25932
The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474
9.1
CVE-2023-22599
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash…
8.8
CVE-2022-21182
A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4
8.6
CVE-2023-22601
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently…
8.1
CVE-2023-22600
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control