Inrouter302 Firmware vulnerabilities

7 known vulnerabilities in Inrouter302 Firmware from Inhandnetworks. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  InRouter 302: Use of Insufficiently Random Values

  CVE-2023-22601Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unautho

• 8.1 High severity

  InRouter 302: Improper Access Control

  CVE-2023-22600Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same netw

• 9.1 Critical severity

  InRouter 302: Use of a One-Way Hash with a Predictable Salt

  CVE-2023-22599Jan 12, 2023InHand Networks

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requ

• 7.2 High severity

  InRouter 302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-22598Jan 12, 2023InHand NetworksEPSS 1.69%

  InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthoriz

• 9.8 Critical severity

  InRouter302: Improper Access Control

  CVE-2022-25932Nov 9, 2022InHand Networks

  The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulnerability.

• 8.1 High severity

  InRouter302: Unrestricted Upload of File with Dangerous Type

  CVE-2022-21809May 12, 2022InHand NetworksEPSS 1.82%

  A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.

• 8.8 High severity

  InRouter302: Improper Access Control

  CVE-2022-21182May 12, 2022InHand NetworksEPSS 1.97%

  A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerab