PT-2021-22136 · Inhand Networks · Inhand Networks Ir615 Router

Alik Koldobsky + 4 · Published 2021-10-19 · Updated 2021-10-22 · CVE-2021-38462

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The issue is related to the lack of an efficient password policy enforcement. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users, performing operations on their behalf.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider implementing a strong password policy to mitigate the risk of password enumeration and impersonation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2021-38462

Affected Products

Inhand Networks Ir615 Router

References · 4

• https://osv.dev/vulnerability/CVE-2021-38462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38462 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note
• https://t.me/cibsecurity/30765 · Telegram Post