CVE-2021-38472: InHand Networks IR615 Router

Reference Links

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-280-05 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-21-280-05

Frequently Asked Questions

• What is CVE-2021-38472?

  CVE-2021-38472 is a vulnerability in InHand Networks IR615 Router's management portal that allows an attacker to frame the portal and trick administrators into performing malicious actions.

• How can an attacker exploit CVE-2021-38472?

  An attacker can exploit CVE-2021-38472 by sending a link to an administrator that frames the router's management portal and tricks the administrator into performing unauthorized actions.

• What is the severity of CVE-2021-38472?

  The severity of CVE-2021-38472 is medium with a CVSS score of 4.7.

• Which versions of InHand Networks IR615 Router are affected by CVE-2021-38472?

  Versions 2.3.0.r4724 and 2.3.0.r4870 of InHand Networks IR615 Router are affected by CVE-2021-38472.

• How can I mitigate CVE-2021-38472?

  To mitigate CVE-2021-38472, update to a version of InHand Networks IR615 Router software that includes an X-FRAME-OPTIONS header to prevent framing attacks.