PT-2021-22158 · Inhand Networks · Inhand Networks Ir615 Router

Published 2021-10-19 · Updated 2021-10-22 · CVE-2021-38484

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870

Description The issue allows an attacker, acting as an administrator, to upload malicious files to the server due to the lack of a filter or signature check. This could result in cross-site scripting, deletion of system files, and remote code execution.

Recommendations For versions 2.3.0.r4724 and 2.3.0.r4870, consider restricting access to file upload functionality until a patch is available. As a temporary workaround, consider implementing additional server-side checks to detect and prevent malicious file uploads. Restrict administrator access to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-38484

Affected Products

Inhand Networks Ir615 Router

References · 4

• https://osv.dev/vulnerability/CVE-2021-38484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38484 · Security Note
• https://t.me/cibsecurity/30761 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05 · Note