CVE-2023-22599
published 2023-01-12CVE-2023-22599: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use…
PriorityP347critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.32%
23.8th percentile
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They
send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inhand_networks | inrouter_302 | < IR302 V3.5.56 | IR302 V3.5.56 |
| inhand_networks | inrouter_615 | < InRouter6XX-S-V2.3.0.r5542 | InRouter6XX-S-V2.3.0.r5542 |
| inhandnetworks | inrouter302_firmware | < 3.5.56 | 3.5.56 |
| inhandnetworks | inrouter615-s_firmware | < 2.3.0.r5542 | 2.3.0.r5542 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
InHand Networks InRouter
cisa_ics·2023-01-13·CVSS 6.5
[MEDIUM] InHand Networks InRouter
ICS Advisory
##
InHand Networks InRouter
Last RevisedJanuary 13, 2023
Alert CodeICSA-23-012-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: InHand Networks
- Equipment: InRouter302, InRouter615
- Vulnerabilities: Cleartext Transmission of Sensitive Information, OS Command Injection, Use of a One-way Hash with a Predictable Salt, Improper Access Control, Use of Insufficiently Random Values
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow a message queuing telemetry transport (MQTT) command injection, unauthorized disclosure of sensitive device information, and remote code execution. If properly chained, these vulnerabilities could result in an unauthorized remote us
GHSA
GHSA-3q43-m4hc-qh5p: InHand Networks InRouter 302, prior to version IR302 V3
ghsa_unreviewed·2023-01-13
CVE-2023-22599 [CRITICAL] CWE-760 GHSA-3q43-m4hc-qh5p: InHand Networks InRouter 302, prior to version IR302 V3
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-12
Published