InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to…
Priority MEDIUM 50CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Fixed InRouter 302 (InHand Networks): IR302 V3.5.56InRouter 615 (InHand Networks): InRouter6XX-S-V2.3.0.r5542
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| InHand Networks | InRouter 302 | before IR302 V3.5.56 | IR302 V3.5.56 | Patch available | CNA |
| InHand Networks | InRouter 615 | before InRouter6XX-S-V2.3.0.r5542 | InRouter6XX-S-V2.3.0.r5542 | Patch available | CNA |
- InRouter 302 VendorInHand Networks Affected before IR302 V3.5.56 Fixed in IR302 V3.5.56 Patch available CNA
- InRouter 615 VendorInHand Networks Affected before InRouter6XX-S-V2.3.0.r5542 Fixed in InRouter6XX-S-V2.3.0.r5542 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:inhandnetworks:inrouter302_firmware:*:*:*:*:*:*:*:* | before 3.5.56 | Vulnerable | InHand Networks |
| cpe:2.3:h:inhandnetworks:inrouter302:-:*:*:*:*:*:*:* | not specified by NVD | Running on | InHand Networks |
| cpe:2.3:o:inhandnetworks:inrouter615-s_firmware:*:*:*:*:*:*:*:* | before 2.3.0.r5542 | Vulnerable | InHand Networks |
| cpe:2.3:h:inhandnetworks:inrouter615-s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | InHand Networks |
- cpe:2.3:o:inhandnetworks:inrouter302_firmware:*:*:*:*:*:*:*:* Versions before 3.5.56 Vulnerable ·InHand Networks
- cpe:2.3:h:inhandnetworks:inrouter302:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·InHand Networks
- cpe:2.3:o:inhandnetworks:inrouter615-s_firmware:*:*:*:*:*:*:*:* Versions before 2.3.0.r5542 Vulnerable ·InHand Networks
- cpe:2.3:h:inhandnetworks:inrouter615-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·InHand Networks
Remediation
- Fix · CNA InRouter 302 (InHand Networks) Fixed in IR302 V3.5.56
- Fix · CNA InRouter 615 (InHand Networks) Fixed in InRouter6XX-S-V2.3.0.r5542
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
InHand Networks InRouter 302, InRouter 615 IR302 V3.5.56, InRouter6XX-S-V2.3.0.r5542
5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2023-08790 Improper access control in InHand Networks InRouter 302Priority MEDIUM 49
- TI-2023-08789 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to…Priority LOW 39
- TI-2023-08788 OS command injection in InHand Networks InRouter 302Priority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22601
- 2026-10-03 Alias added: GHSA-8rgq-7c98-wxpm
References
More InHand Networks Inrouter302 Firmware vulnerabilities
- TI-2022-05581 Improper access control in InHand Networks InRouter302 CVSS 3.1HIGH 8.8
- TI-2022-06181 Unrestricted file upload in InHand Networks InRouter302 CVSS 3.1HIGH 8.1
- TI-2022-05629 Cross-site scripting in InHand Networks InRouter302 CVSS 3.1MEDIUM 6.1
- TI-2023-08790 Improper access control in InHand Networks InRouter 302 CVSS 3.1CRITICAL 10.0
- TI-2022-09477 Improper access control in InHand Networks InRouter302 CVSS 3.1CRITICAL 9.8
- TI-2023-08789 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-22601 · CVE Program
- CVE-2023-22601 · NVD
- FIRST EPSS
- GHSA-8rgq-7c98-wxpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences