description:
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.
problem types: CWE-319 Cleartext Transmission of Sensitive Information
affected:
{
defaultStatus: unaffected
product: InRouter 302
vendor: InHand Networks
versions:
lessThan: IR302 V3.5.56, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: InRouter 615
vendor: InHand Networks
versions:
lessThan: InRouter6XX-S-V2.3.0.r5542, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL