Lucene search
PRIOn knowledge basePRION:CVE-2023-22597HistoryJan 12, 2023 - 11:15 p.m.
Command injection
2023-01-1223:15:00
PRIOn knowledge base
www.prio-n.com
1
inhand networks
inrouter 302
inrouter 615
vulnerability
cleartext transmission
sensitive information
unauthorized user
communication
cloud platform
intercept
configuration information
mqtt credentials
command injection
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.
| CPE | Name | Operator | Version |
|---|---|---|---|
| inrouter302_firmware | lt | 3.5.56 | |
| inrouter615-s_firmware | eq | < 2.3.0.r5542 |
Related
cve
cve
CVE-2023-22597
2023-01-12 23:15:10
nvd
nvd
CVE-2023-22597
2023-01-12 23:15:10
cvelist
cvelist
CVE-2023-22597
2023-01-12 22:27:53
ics
ics
InHand Networks InRouter
2023-01-13 12:00:00