CVE-2022-25172highCWE-1004

CVE-2022-25172: high-severity vulnerability in InHand Networks InRouter302

Published · Updated

Follow this CVE+ Monitor InRouter302

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
In short

The InRouter302 web interface stores session cookies without the HttpOnly protection flag, allowing attackers to steal these cookies through JavaScript-based attacks. This enables unauthorized access to user accounts if an attacker can inject malicious scripts.

Technical detail

A missing HttpOnly flag on session cookies in InRouter302 V3.5.4 web interface allows cross-site scripting (XSS) attacks to access and exfiltrate session tokens via JavaScript. The vulnerability requires a prior XSS vector but enables complete session hijacking, leading to authentication bypass and administrative access compromise.

Summary generated and translated by AI from the official description.
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
InHand Networks · InRouter302
Related CVEs — InHand Networks InRouter302

In the same product, most dangerous first.

CVE-2022-26085CRITICALCVE-2022-26085EPSS 12.7%CVE-2022-26042CRITICALCVE-2022-26042EPSS 8.6%CVE-2022-26420CRITICALCVE-2022-26420EPSS 5.9%CVE-2022-26075CRITICALCVE-2022-26075EPSS 5.9%CVE-2022-26007CRITICALCVE-2022-26007EPSS 5.4%CVE-2022-26518CRITICALCVE-2022-26518EPSS 4.9%