Lucene search

IcscertCVE-2021-38486

HistoryOct 19, 2021 - 1:15 p.m.

CVE-2021-38486

2021-10-1913:15:11

CWE-285

CWE-862

icscert

web.nvd.nist.gov

cve-2021-38486

inhand networks

ir615 router

cloud portal

self-registration

account creation

code execution

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

InHand Networks IR615 Router’s Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to which the product is connected.

Affected configurations

Nvd

Node

inhandnetworksir615_firmwareMatch2.3.0.r4724

AND

inhandnetworksir615Match-

Node

inhandnetworksir615_firmwareMatch2.3.0.r4870

AND

inhandnetworksir615Match-

VendorProductVersionCPE
inhandnetworksir615_firmware2.3.0.r4724cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4724:*:*:*:*:*:*:*
inhandnetworksir615-cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*
inhandnetworksir615_firmware2.3.0.r4870cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4870:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
inhandnetworks	ir615_firmware	2.3.0.r4724	cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4724:::::::*
inhandnetworks	ir615	-	cpe:2.3:h:inhandnetworks:ir615:-:::::::*
inhandnetworks	ir615_firmware	2.3.0.r4870	cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4870:::::::*

CNA Affected

[
  {
    "product": "IR615 Router",
    "vendor": "InHand Networks",
    "versions": [
      {
        "status": "affected",
        "version": "2.3.0.r4724 and 2.3.0.r4870"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-21-280-05

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVE-2021-38486