CVE-2023-22597

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22597
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:inhandnetworks:inrouter302_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:inhandnetworks:inrouter302:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:inhandnetworks:inrouter615-s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:inhandnetworks:inrouter615-s:-:*:*:*:*:*:*:*
History

07 Nov 2023, 04:07

Type Values Removed Values Added
Summary InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection. InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.
Information

Published : 2023-01-12 23:15

Updated : 2024-02-28 19:51

NVD link : CVE-2023-22597

Mitre link : CVE-2023-22597

CVE.ORG link : CVE-2023-22597

JSON object : View

Products Affected

inhandnetworks

  • inrouter302_firmware
  • inrouter302
  • inrouter615-s_firmware
  • inrouter615-s
CWE
CWE-319

Cleartext Transmission of Sensitive Information