CVE-2023-22599
Description
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.
How to fix
- inhandnetworks inrouter302_firmware3.5.56 or later
- inhandnetworks inrouter615-s_firmware2.3.0.r5542 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inhandnetworks inrouter302_firmware | v < 3.5.56 | 3.5.56 |
| inhandnetworks inrouter615-s_firmware | v < 2.3.0.r5542 | 2.3.0.r5542 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.