InRouter 302 vulnerabilities

4 known vulnerabilities in InRouter 302 from InHand Networks. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  InRouter 302: Use of Insufficiently Random Values

  CVE-2023-22601Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unautho

• 8.1 High severity

  InRouter 302: Improper Access Control

  CVE-2023-22600Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same netw

• 9.1 Critical severity

  InRouter 302: Use of a One-Way Hash with a Predictable Salt

  CVE-2023-22599Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requ

• 7.2 High severity

  InRouter 302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-22598Jan 12, 2023InHand NetworksEPSS 1.69%

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthoriz