CVE-2021-38472 - OpenCVE

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and could lure the administrator to perform changes.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Inhandnetworks	Ir615 Ir615 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4724:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4870:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2021-10-19T12:10:48.128551Z

Updated: 2024-09-16T22:30:31.547Z

Reserved: 2021-08-10T00:00:00

Link: CVE-2021-38472

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-10-19T13:15:11.120

Modified: 2021-10-22T14:12:28.027

Link: CVE-2021-38472

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "IR615 Router", "vendor": "InHand Networks", "versions": [{"status": "affected", "version": "2.3.0.r4724 and 2.3.0.r4870"}]}], "credits": [{"lang": "en", "value": "Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA."}], "datePublic": "2021-10-07T00:00:00", "descriptions": [{"lang": "en", "value": "InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router\u2019s management portal and could lure the administrator to perform changes."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "description": "IMPROPER RESTRICTION OF RENDERED UI LAYERS OR FRAMES CWE-1021", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-19T12:10:48", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05"}], "source": {"advisory": "ICSA-21-280-05", "discovery": "UNKNOWN"}, "title": "InHand Networks IR615 Router", "workarounds": [{"lang": "en", "value": "InHand Networks has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of this affected product are invited to contact InHand Networks customer support."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2021-10-07T20:12:00.000Z", "ID": "CVE-2021-38472", "STATE": "PUBLIC", "TITLE": "InHand Networks IR615 Router"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "IR615 Router", "version": {"version_data": [{"version_affected": "=", "version_value": "2.3.0.r4724 and 2.3.0.r4870"}]}}]}, "vendor_name": "InHand Networks"}]}}, "credit": [{"lang": "eng", "value": "Haviv Vaizman, Hay Mizrachi, Alik Koldobsky, Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router\u2019s management portal and could lure the administrator to perform changes."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "IMPROPER RESTRICTION OF RENDERED UI LAYERS OR FRAMES CWE-1021"}]}]}, "references": {"reference_data": [{"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05"}]}, "source": {"advisory": "ICSA-21-280-05", "discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "InHand Networks has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of this affected product are invited to contact InHand Networks customer support."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:44:22.914Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-38472", "datePublished": "2021-10-19T12:10:48.128551Z", "dateReserved": "2021-08-10T00:00:00", "dateUpdated": "2024-09-16T22:30:31.547Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4724:*:*:*:*:*:*:*", "matchCriteriaId": "FFF0F3C9-F950-422F-ACB1-FE653373FF19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3237242-CF6E-4390-A9F7-85CE2C9BA29C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:inhandnetworks:ir615_firmware:2.3.0.r4870:*:*:*:*:*:*:*", "matchCriteriaId": "A64C65DB-6951-4371-A331-A9F7A871AFB9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3237242-CF6E-4390-A9F7-85CE2C9BA29C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router\u2019s management portal and could lure the administrator to perform changes."}, {"lang": "es", "value": "InHand Networks IR615 Router's Versiones 2.3.0.r4724 y 2.3.0.r4870, el portal de administraci\u00f3n no contiene un encabezado X-FRAME-OPTIONS, de la que un atacante puede aprovecharse mediante el env\u00edo de un enlace a un administrador que enmarque el portal de administraci\u00f3n del router y pueda atraer al administrador para que lleve a cabo cambios"}], "id": "CVE-2021-38472", "lastModified": "2021-10-22T14:12:28.027", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2021-10-19T13:15:11.120", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-1021"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}