PT-2021-22148 · Inhand Networks · Inhand Networks Ir615 Router

Published 2021-10-19 · Updated 2021-10-22 · CVE-2021-38474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The issue is related to the absence of an account lockout policy for the login page, which may allow an attacker to perform a brute-force password attack without time limitations, potentially gaining valid credentials for the product interface.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider implementing an account lockout policy to limit the number of incorrect login attempts to prevent brute-force password attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-38474

Affected Products

Inhand Networks Ir615 Router

References · 4

• https://osv.dev/vulnerability/CVE-2021-38474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38474 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note
• https://t.me/cibsecurity/30752 · Telegram Post