CVE-2022-26518
📋 TL;DR
CVE-2022-26518 is an OS command injection vulnerability in InHand Networks InRouter302's console infactory_net functionality that allows remote attackers to execute arbitrary commands on affected devices. This vulnerability affects InRouter302 devices running firmware version V3.5.37, potentially enabling remote code execution without authentication.
💻 Affected Systems
- InHand Networks InRouter302
📦 What is this software?
Ir302 Firmware by Inhandnetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network pivoting to internal systems, data exfiltration, and device bricking.
Likely Case
Remote code execution allowing attacker to modify device configuration, intercept network traffic, or use device as part of botnet.
If Mitigated
Limited impact if device is behind firewall with restricted inbound access and proper network segmentation.
🎯 Exploit Status
The vulnerability requires sending a specially-crafted sequence of network requests to trigger command injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.5.45 or later
Vendor Advisory: https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf
Restart Required: Yes
Instructions:
1. Download firmware version V3.5.45 or later from InHand Networks support portal. 2. Log into router web interface. 3. Navigate to System > Firmware Upgrade. 4. Upload new firmware file. 5. Apply upgrade and wait for automatic reboot.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to router management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote management features in router configuration.
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for unusual outbound connections from routers
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Status > Firmware Version. If version is V3.5.37, device is vulnerable.Check Version:
curl -s http://router-ip/status | grep -i firmwareVerify Fix Applied:
Verify firmware version is V3.5.45 or later after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to console infactory_net endpoints
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns suggesting command-and-control communication
SIEM Query:
source="router_logs" AND (uri="/console/infactory_net" OR cmd="*;*" OR cmd="*|*")