PT-2021-22144 · Inhand Networks · Inhand Networks Ir615 Router

Published 2021-10-19 · Updated 2021-10-22 · CVE-2021-38470

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The issue allows an attacker to inject commands into the device using a ping tool, potentially enabling the attacker to remotely run commands on behalf of the device.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider restricting access to the device to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of ping tools on the network to prevent potential command injection.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-38470

Affected Products

Inhand Networks Ir615 Router

References · 3

• https://osv.dev/vulnerability/CVE-2021-38470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38470 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note