CVE-2021-38480

Summary

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to cross-site request forgery when unauthorized commands are submitted from a user the web application trusts. This may allow an attacker to remotely perform actions on the router’s management portal, such as making configuration changes, changing administrator credentials, and running system commands on the router.

Affected Software

VendorProductVersion RangeStatus
InHand NetworksIR615 Router2.3.0.r4724 and 2.3.0.r4870affected

Weaknesses

  • CWE-352: CROSS-SITE REQUEST FORGERY (CSRF) CWE-352

Workarounds

InHand Networks has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of this affected product are invited to contact InHand Networks customer support.

ADP Enrichment

CVE Program Container

Additional References

References