Critical ICSA-23-012-03 5 CVEs

InHand Networks InRouter

Published Jan 12, 2023 · Updated Jan 12, 2023

Vendor: InHand Networks Product: InRouter 302 Product: InRouter 615

Summary

Successful exploitation of these vulnerabilities could allow a message queuing telemetry transport (MQTT) command injection, unauthorized disclosure of sensitive device information, and remote code execution. If properly chained, these vulnerabilities could result in an unauthorized remote user fully compromising every cloud-managed InHand Networks device reachable by the cloud.

Vulnerabilities 5

Critical 10.0

CVE-2023-22600

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…

InHand Networks InRouter 615 InRouter 302

Jan 12, 2023
Critical 10.0

CVE-2023-22601

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…

InHand Networks InRouter 615 InRouter 302

Jan 12, 2023
High 7.2

CVE-2023-22598

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…

InHand Networks InRouter 615 InRouter 302

Jan 12, 2023
High 7.0

CVE-2023-22599

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…

InHand Networks InRouter 302 InRouter 615

Jan 12, 2023
Medium 6.5

CVE-2023-22597

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…

InHand Networks InRouter 302 InRouter 615

Jan 12, 2023

Revision history

2023-01-12 #1
Publication Date

References

ICS Advisory ICSA-23-012-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-012-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf