InRouter302 vulnerabilities

18 known vulnerabilities in InRouter302 from InHand Networks. 18 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

18vulnerabilities

1critical

17high

0exploited

8.6average CVSS score

Latest first

8.8 High severity
InRouter302: Active Debug Code
CVE-2022-30543Nov 9, 2022InHand NetworksEPSS 1.11%
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to
8.1 High severity
InRouter302: Active Debug Code
CVE-2022-29888Nov 9, 2022InHand NetworksEPSS 1.62%
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulner
8.8 High severity
InRouter302: Active Debug Code
CVE-2022-28689Nov 9, 2022InHand NetworksEPSS 1.14%
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vul
9.8 Critical severity
InRouter302: Improper Access Control
CVE-2022-25932Nov 9, 2022InHand Networks
The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulnerability.
8.8 High severity
InRouter302: Use of Hard-coded Credentials
CVE-2022-27172May 12, 2022InHand NetworksEPSS 1.08%
A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request can lead to privileged operation execution. An attacker can send a sequence of requests to trigger thi
8.8 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26782May 12, 2022InHand NetworksEPSS 3.29%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26781May 12, 2022InHand NetworksEPSS 2.94%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import…
CVE-2022-26780May 12, 2022InHand NetworksEPSS 3.29%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26518May 12, 2022InHand NetworksEPSS 4.85%
An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tri
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26420May 12, 2022InHand NetworksEPSS 5.92%
An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26085May 12, 2022InHand NetworksEPSS 12.7%
An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger th
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26075May 12, 2022InHand NetworksEPSS 5.92%
An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26042May 12, 2022InHand NetworksEPSS 8.61%
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this v
7.2 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26007May 12, 2022InHand NetworksEPSS 5.45%
An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerabilit
7.2 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26002May 12, 2022InHand NetworksEPSS 3.41%
A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigge
8.8 High severity
InRouter302: Active Debug Code
CVE-2022-25995May 12, 2022InHand NetworksEPSS 2.86%
A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnera
8.1 High severity
InRouter302: Unrestricted Upload of File with Dangerous Type
CVE-2022-21809May 12, 2022InHand NetworksEPSS 1.82%
A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.
8.8 High severity
InRouter302: Improper Access Control
CVE-2022-21182May 12, 2022InHand NetworksEPSS 1.97%
A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerab