by Kastro
Paper/Archive/CVE-2021-38474

CVE-2021-38474

InHand Networks IR615 Router — InHand Networks IR615 Router

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. This could allow an attacker to gain valid credentials for the product interface.

Affected

ProductAffectedFixed inSource
IR615 Router2.3.0.r4724 and 2.3.0.r4870–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

refus-cert.cisa.gov/ics/advisories/icsa-21-280-05