CVE-2022-26782

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input validation vulnerability exists in the `httpd`'s `user_define_set_item` function. Controlling the `user_define_timeout` nvram variable can lead to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-787

Affected software

VendorProductVersions
InHand NetworksInRouter302V3.5.4

References

Timeline

Published
May 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-267836.5Windows Hyper-V Shared Virtual Hard Disks Information Disclosure VulnerabilityCVE-2022-267846.5Windows Cluster Shared Volume (CSV) Denial of Service VulnerabilityCVE-2022-267856.5Windows Hyper-V Shared Virtual Hard Disks Information Disclosure VulnerabilityCVE-2022-267867.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-267877.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-267887.8PowerShell Elevation of Privilege VulnerabilityCVE-2022-267897.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26799.8A vulnerability was found in SourceCodester Interview Management System 1.0. It has been rated as critical. This issue affects some unknown CVE-2022-267907.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-267917.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-267927.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-267937.8Windows Print Spooler Elevation of Privilege Vulnerability