InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.
References
Link | Resource |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03 | Third Party Advisory US Government Resource |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: icscert
Published: 2023-01-12T22:34:14.532Z
Updated:
Reserved: 2023-01-03T19:55:20.124Z
Link: CVE-2023-22601
JSON object: View
NVD Information
Status : Modified
Published: 2023-01-12T23:15:10.527
Modified: 2023-11-07T04:07:05.840
Link: CVE-2023-22601
JSON object: View
Redhat Information
No data.
CWE