VULNERABILITY INTELLIGENCE

CVE-2023-22597

CVSS score6.5 MEDIUM
EPSS probability0.53%
CISA KEVNot currently listed
Published2023-01-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Description

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.

Weakness classification

  • ics-cert@hq.dhs.gov: CWE-319

Primary references