CVE-2022-26020

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

Vendor	Product	Versions
InHand Networks	InRouter302	V3.5.4

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1474Exploit, Technical Description, Third Party Advisory
https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdfVendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1474Exploit, Technical Description, Third Party Advisory
https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdfVendor Advisory

Timeline

Published: May 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-260227.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may all CVE-2022-260236.5A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted s CVE-2022-260247.8Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allo CVE-2022-260267.5A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.CVE-2022-260287.3Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially CVE-2022-26038.8Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a cra CVE-2022-260327.3Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Tool CVE-2022-260349.1Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09 CVE-2022-26048.8Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via CVE-2022-260416.5Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read CVE-2022-260428.8An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafte CVE-2022-260437.5An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V