Skip to main content

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability Affecting InHand Networks InRouters

17 January 2023

Security researchers have discovered an improper access control vulnerability (CVE-2023-22600) affecting InHand Network Inrouters. The vulnerability has a Common Vulnerability Scoring System (CVSS) score of 10 out of 10.

Successful exploitation of the vulnerability could allow unauthenticated devices to subscribe to message queuing telemetry transport (MQTT) topics on the same network as the device manager. An attacker with prior knowledge of the topics could send and receive messages to and from an existing topic and perform command or code execution and information disclosure.

The following versions of InRouters are affected:

  • InRouter 302: All versions prior to IR302 V3.5.56

  • InRouter 615: All versions prior to InRouter6XX-S-V2.3.0.r5542

Administrators and users are advised to upgrade affected devices to the following firmware versions immediately:

  • InRouter302 firmware to IR302 V3.5.56 or later

  • InRouter615 firmware to InRouter6XX-S-V2.3.0.r5542 or later

More information is available here:

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03

Back to top