InRouter 302: Use of a One-Way Hash with a Predictable Salt
CVE-2023-22599 is a critical-severity use of a one-way hash with a predictable salt vulnerability in InRouter 302 from InHand Networks, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version IR302 V3.5.56 as the first without the flaw, so updating InRouter 302 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.34% chance of exploitation within 30 days, which is low compared with other CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update InRouter 302 to IR302 V3.5.56 or a later version.
- Update InRouter 615 to InRouter6XX-S-V2.3.0.r5542 or a later version.
- Update Inrouter302 Firmware to 3.5.56 or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| InHand Networks | InRouter 302 | before IR302 V3.5.56 | IR302 V3.5.56 |
| InHand Networks | InRouter 615 | before InRouter6XX-S-V2.3.0.r5542 | InRouter6XX-S-V2.3.0.r5542 |
| Inhandnetworks | Inrouter302 Firmware | before 3.5.56 | 3.5.56 |
| Inhandnetworks | Inrouter615-s Firmware | before 2.3.0.r5542 | 2.3.0.r5542 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.0 | High | CNA (hq.dhs.gov) |
| CVSS 3.1 | 9.1 | Critical | NVD |
Official description
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of a One-Way Hash with a Predictable Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
How developers prevent this class of flaw
- If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.
More Use of a One-Way Hash with a Predictable Salt vulnerabilities (CWE-760)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- cisa.gov/uscert/ics/advisories/icsa-23-012-03Third Party Advisory, US Government Resource
Other vulnerabilities in InRouter 302
- 8.6 High severity
- 8.1 High severity
- 7.2 High severity
Spotted an error? Tell us.