CVE-2021-38462

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
InHand Networks	IR615 Router	2.3.0.r4724 and 2.3.0.r4870

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05Third Party Advisory, US Government Resource

Timeline

Published: Oct 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384638.1The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using AP CVE-2021-384647.4InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have inadequate encryption strength, which may allow an attacker to inte CVE-2021-384656.5The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieve CVE-2021-384666.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the h CVE-2021-384678.1A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory reg CVE-2021-384684.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to CVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncon CVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the w CVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create n CVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an a CVE-2021-384738.8The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.