CVE-2021-38484: Unrestricted Upload of File with Dangerous Type

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server, which may allow an attacker, acting as an administrator, to upload malicious files. This could result in cross-site scriptin...

CVE-2021-38482: Improper Neutralization of Input During Web Page Generation

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 website used to control the router is vulnerable to stored cross-site scripting, which may allow an attacker to hijack sessions of users connected to the system...

CVE-2021-38462: Weak Password Requirements

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf...

CVE-2021-38476: Observable Response Discrepancy

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts...

CVE-2021-38466: Improper Neutralization of Input During Web Page Generation

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack, which could allow an attacker to run code on behalf of the client...

CVE-2021-38464: Inadequate Encryption Strength

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to intercept the communication and steal sensitive information or hijack the session...

CVE-2021-38468: Improper Neutralization of Input During Web Page Generation

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to hijack sessions of users connected to the system...

CVE-2021-38470: Improper Neutralization of Special Elements used in an OS Command

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...

CVE-2021-38474: Improper Restriction of Excessive Authentication Attempts

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. Th...

CVE-2021-38480: Cross-Site Request Forgery (CSRF)

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands are submitted from a user the web application trusts. This may allow an attacker to remotely perform actions on the router’s management portal, such as makin...

PT-2021-22158

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue allows an attacker, acting as an administrator, to upload malicious files to the server due to the lack of a filter or signature check. This could resu...

CVE-2021-38472: Improper Restriction of Rendered UI Layers or Frames

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and could lure the administrator to perform...

PT-2021-22155

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue allows an attacker to perform cross-site request forgery when unauthorized commands are submitted from a trusted user, enabling remote actions on the...

PT-2021-22148

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue is related to the absence of an account lockout policy for the login page, which may allow an attacker to perform a brute-force password attack without...

PT-2021-22150

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The authentication process in the affected router versions indicates and validates the existence of a username in its response. This behavior may allow an attack...

CVE-2021-38486: Improper Authorization

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the internal network to...

PT-2021-22146

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The management portal of the affected router does not contain an X-FRAME-OPTIONS header. This could be exploited by an attacker who sends a link to an...

Unspecified vulnerability exists in IR615 Router (CNVD-2021-82943)

The IR615 Router is a 4G industrial router from Rimu Technologies, China. The IR615 Router has a security vulnerability that could be exploited by an attacker to obtain user credentials to enumerate passwords and emulate other application users and perform actions on their behalf...

IR615 Router authorization issue vulnerability

The IR615 Router is a 4G industrial router from Rimu Technologies of China. The IR615 Router is vulnerable to an authorization issue that could be exploited by an attacker to take full control of the product and execute code on the internal network to which the product is connected...

IR615 Router Cross-site Request Forgery Vulnerability

The IR615 Router is a 4G industrial router from Rimu Technologies, China. IR615 Router is vulnerable to cross-site request forgery, which can be exploited by attackers to remotely execute operations on the router's management portal...