CVE-2022-26007
📋 TL;DR
This CVE describes an OS command injection vulnerability in InHand Networks InRouter302's console factory functionality. Attackers can execute arbitrary commands on affected devices by sending specially crafted network requests. Organizations using InRouter302 V3.5.4 devices are affected.
💻 Affected Systems
- InHand Networks InRouter302
📦 What is this software?
Ir302 Firmware by Inhandnetworks
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, pivot to internal networks, or use device as botnet node.
Likely Case
Unauthenticated remote code execution leading to device takeover, credential theft, and network reconnaissance.
If Mitigated
Limited impact if devices are behind firewalls with restricted network access and proper segmentation.
🎯 Exploit Status
Exploit details published in Talos report; requires network access to device but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.5.45 or later
Vendor Advisory: https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf
Restart Required: Yes
Instructions:
1. Download latest firmware from InHand Networks support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to InRouter302 devices using firewall rules
Disable Console Factory
allDisable console factory functionality if not required
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from InRouter302 devices
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI; if version is V3.5.4, device is vulnerable.Check Version:
Check via web interface: System > System Info > Firmware VersionVerify Fix Applied:
Verify firmware version is V3.5.45 or later after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by console factory access
Network Indicators:
- Unexpected network traffic to console factory ports
- Outbound connections from InRouter302 to unknown destinations
SIEM Query:
source="inrouter302" AND (event="command_execution" OR event="console_factory_access")