PT-2021-22146 · Inhand Networks · Ir615 Router

Published 2021-10-19 · Updated 2021-10-22 · CVE-2021-38472

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The management portal of the affected router does not contain an X-FRAME-OPTIONS header. This could be exploited by an attacker who sends a link to an administrator, framing the router's management portal and potentially luring the administrator into making changes.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider disabling access to the management portal until a patch is available that includes the X-FRAME-OPTIONS header. Restrict access to the management portal to minimize the risk of exploitation.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-38472

Affected Products

Ir615 Router

References · 4

• https://osv.dev/vulnerability/CVE-2021-38472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38472 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note
• https://t.me/cibsecurity/30766 · Telegram Post