PT-2022-17631

CVE-2022-26007

Published

2022-05-12

Updated

2022-05-23

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InRouter302 version 3.5.4

Description A command injection issue exists in the console factory functionality, allowing a specially-crafted network request to lead to command execution. An attacker can exploit this by sending a sequence of requests.

Recommendations For version 3.5.4, consider restricting access to the console factory functionality until a patch is available. As a temporary workaround, limit the ability to send specially-crafted network requests to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers

CVE-2022-26007