CVE-2021-38462

Published: Oct 19, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf.

Affected (2)

Products: Inhandnetworks: Ir615 Firmware

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Inhandnetworks Ir615 Firmware	Version 2.3.0.r4724

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Inhandnetworks Ir615 Firmware	Version 2.3.0.r4870

Running on/with	Platform Versions
Inhandnetworks Ir615	All versions

Related CWEs

Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

References (2)

https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.