CVE-2023-22600criticalCWE-284

CVE-2023-22600: falha crítica em InHand Networks InRouter 302

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar InRouter

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.5%
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same network as the device manager. An unauthorized user who knows of an existing topic name could send and receive messages to and from that topic. This includes the ability to send GET/SET configuration commands, reboot commands, and push firmware updates.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Produtos afetados
InHand Networks · InRouter 302InHand Networks · InRouter 615
CVEs relacionadas — InHand Networks InRouter 302

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22598HIGHCVE-2023-22598EPSS 1.7%CVE-2023-22601CRITICALCVE-2023-22601EPSS 0.6%CVE-2023-22597MEDIUMCVE-2023-22597EPSS 0.5%CVE-2023-22599HIGHCVE-2023-22599EPSS 0.3%