PT-2023-1275 · Inhand Networks · Inrouter 615+1

Otorio + 1 · Published 2023-01-03 · Updated 2023-01-23 · CVE-2023-22597

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542

Description The issue is related to the use of an unsecured channel for data transmission by default, which may allow a remote attacker to gain unauthorized access to sensitive information or execute arbitrary commands using the MQTT protocol. This could enable an unauthorized user to intercept communication and steal sensitive information, such as configuration information and MQTT credentials, potentially allowing MQTT command injection.

Recommendations For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later. As a temporary workaround, consider restricting access to the MQTT protocol to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2023-00543

CVE-2023-22597

Affected Products

Inrouter302

Inrouter 615

References · 6

• https://osv.dev/vulnerability/CVE-2023-22597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22597 · Security Note
• https://bdu.fstec.ru/vul/2023-00543 · Security Note
• https://inhandnetworks.com/products/inrouter615-s.html#link4 · Note
• https://inhandnetworks.com/products/inrouter300.html#link4 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-23-012-03 · Note