CVE-2022-30543

A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to trigger this vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf	Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519	Exploit Technical Description Third Party Advisory
https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf	Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:inhandnetworks:ir302_firmware:3.5.45:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir302:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:02

Type	Values Removed	Values Added
References	~~() https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf - Vendor Advisory~~	() https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf - Vendor Advisory
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519 - Exploit, Technical Description, Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519 - Exploit, Technical Description, Third Party Advisory

Information

Published : 2022-11-09 18:15

Updated : 2024-11-21 07:02

NVD link : CVE-2022-30543

Mitre link : CVE-2022-30543

CVE.ORG link : CVE-2022-30543

JSON object : View

Products Affected

inhandnetworks

ir302_firmware
ir302

CWE

CWE-489

Active Debug Code

NVD-CWE-Other

{"id": "CVE-2022-30543", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-11-09T18:15:14.983", "references": [{"url": "https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf", "tags": ["Vendor Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-489"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de c\u00f3digo de depuraci\u00f3n sobrante en la funcionalidad de infecci\u00f3n de la consola de InHand Networks InRouter302 V3.5.45. Una serie de solicitudes de red especialmente manipuladas pueden conducir a la ejecuci\u00f3n de operaciones privilegiadas. Un atacante puede enviar una secuencia de solicitudes para desencadenar esta vulnerabilidad."}], "lastModified": "2024-11-21T07:02:54.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:inhandnetworks:ir302_firmware:3.5.45:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCD75096-9011-4F14-BE6C-B64A187954F0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:inhandnetworks:ir302:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0E358655-E442-4D2C-B0B8-03C6780EC55C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}