What is CVE-2023-22597?

CVE-2023-22597 is a medium-severity vulnerability in Inhand Networks Inrouter 302, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2023-01-12.

How severe is CVE-2023-22597?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Inhand Networks Inrouter 302

CVE-2023-22597

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.

EPSS: 0.005 (40.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N.

Affected products

Inhand Networks Inrouter 302 — versions 0
Inhand Networks Inrouter 615 — versions 0
Inhandnetworks Inrouter302
Inhandnetworks Inrouter302_firmware
Inhandnetworks Inrouter615-s
Inhandnetworks Inrouter615-s_firmware

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, government-resource)

Frequently asked questions

What is CVE-2023-22597?: CVE-2023-22597 is a medium-severity vulnerability in Inhand Networks Inrouter 302, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2023-01-12.
How severe is CVE-2023-22597?: Medium severity. CVSS v3 base score is 6.5 out of 10.