description:
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.
problem types: CWE-330 Use of Insufficiently Random Values
affected:
{
defaultStatus: unaffected
product: InRouter 302
vendor: InHand Networks
versions:
lessThan: IR302 V3.5.56, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: InRouter 615
vendor: InHand Networks
versions:
lessThan: InRouter6XX-S-V2.3.0.r5542, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL