CVE-2021-38468

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker to hijack sessions of users connected to the system.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncon CVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the w CVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create n CVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an a CVE-2021-384738.8The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.CVE-2021-384749.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the CVE-2021-384758.8The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissi CVE-2021-384765.3InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of CVE-2021-384779.8There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipul CVE-2021-384789.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands CVE-2021-384797.5Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory regions. An attacker c