Medium severity6.1NVD Advisory· Published May 12, 2022· Updated Jun 17, 2026

CVE-2022-25172

Description

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

InHand Networks/Inrouter 302llm-fuzzy2 versions
= V3.5.4+ 1 more
- (no CPE)range: = V3.5.4
- (no CPE)range: V3.5.4
InHand Networks/Ir302 Firmware
cpe:2.3:o:inhandnetworks:ir302_firmware:*:*:*:*:*:*:*:*
Range: <=3.5.4

Patches

Vulnerability mechanics

References

talosintelligence.com/vulnerability_reports/TALOS-2022-1470nvdExploitTechnical DescriptionThird Party Advisory
www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdfnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000