CVE-2023-22598
High
Description
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices could push a specially crafted configuration update file to gain root access. This could lead to remote code execution with root privileges.
SeverityHigh
CVSS7.2
Exploit probability—
ProductInhandnetworks Inrouter302 Firmware
PublishedJan 12, 2023
First seenJan 12, 2023
Weakness typeCWE-78OS command injection
How to fix
Update
- inhandnetworks inrouter302_firmware3.5.56 or later
- inhandnetworks inrouter615-s_firmware2.3.0.r5542 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inhandnetworks inrouter302_firmware | v < 3.5.56 | 3.5.56 |
| inhandnetworks inrouter615-s_firmware | v < 2.3.0.r5542 | 2.3.0.r5542 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.