PT-2021-22152 · Inhand Networks · Inhand Networks Ir615 Router

Alik Koldobsky + 4 · Published 2021-10-19 · Updated 2021-10-25 · CVE-2021-38478

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The issue allows an attacker to use a traceroute tool to inject commands into the device, potentially enabling remote command execution on behalf of the device.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider restricting access to the device to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-38478

Affected Products

Inhand Networks Ir615 Router

References · 4

• https://osv.dev/vulnerability/CVE-2021-38478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38478 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note
• https://t.me/cibsecurity/30758 · Telegram Post