CVE-2022-25932CWE-284

The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474

High · published November 9, 2022

CVSS v3.0
7.4
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

⚡ A simple firmware upgrade didn’t quite tie up loose ends! The InRouter302's fixes for previous vulnerabilities are still vulnerable to privilege escalation and information disclosure. 🔥 Think of it like a hotel that upgraded its security measures but neglected to check if the back door was still propped open — anyone can slip in and access restricted areas. 🏨 An attacker could exploit this oversight to gain unauthorized access and potentially read sensitive information, leading to a significant breach of security. The impact is not just damaging to the device but could also compromise the entire network it connects to, making it a high-risk situation!

Put simply

Think of it like a hotel that upgraded its security measures but neglected to check if the back door was still propped open — anyone can slip in and access restricted areas. 🏨 This vulnerability arises from incomplete fixes in the InHand Networks InRouter302 firmware, allowing attackers to bypass intended security measures and gain higher privileges or access confidential data. Essentially, the patches implemented were not thorough enough to eliminate the risks entirely.

What to do

An attacker could exploit this oversight to gain unauthorized access and potentially read sensitive information, leading to a significant breach of security. The impact is not just damaging to the device but could also compromise the entire network it connects to, making it a high-risk situation! To protect yourself, **upgrade to firmware version 3.5.46 or later** as soon as possible. Additionally, review your network's access controls to limit potential exposure and regularly monitor for unusual activity. 🛡️ You've got this! By taking these steps, you’ll be well on your way to reinforcing your security defenses! 💪

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-11-09T17:35Z
EPSS history
Timeline
  • 09 NOV 17:35Z
    The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474
    cvelistv5