VulnerabilityModified

CVE-2022-25172

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4.

MEDIUM 6.1EPSS 1.02%

Does this matter?

Lower severity and a low EPSS score (1.02%). Track it; it rarely justifies an emergency change on its own.

Description

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.02% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-1004, CWE-732
Affected: inhandnetworks/ir302 firmware
Source: talos-cna@cisco.com

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1470Exploit, Technical Description, Third Party Advisory
https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdfVendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1470Exploit, Technical Description, Third Party Advisory
https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.