Sign-up

ID

VAR-202110-0956


CVE

CVE-2021-38484


TITLE

InHand Networks IR615 Router  Vulnerability in unlimited upload of dangerous types of files in

Trust: 0.8

sources: JVNDB: JVNDB-2021-013886

DESCRIPTION

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server, which may allow an attacker, acting as an administrator, to upload malicious files. This could result in cross-site scripting, deletion of system files, and remote code execution. InHand Networks IR615 Router Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Ruimu Technology IR615 Router is a 4G industrial router of China Ruimu Technology Company

Trust: 2.25

sources: NVD: CVE-2021-38484 // JVNDB: JVNDB-2021-013886 // CNVD: CNVD-2021-82950 // VULMON: CVE-2021-38484

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-82950

AFFECTED PRODUCTS

vendor:inhandnetworksmodel:ir615scope:eqversion:2.3.0.r4724

Trust: 1.0

vendor:inhandnetworksmodel:ir615scope:eqversion:2.3.0.r4870

Trust: 1.0

vendor:inhandmodel:ir615scope:eqversion:ir615 firmware 2.3.0.r4724

Trust: 0.8

vendor:inhandmodel:ir615scope:eqversion:ir615 firmware 2.3.0.r4870

Trust: 0.8

vendor:inhandmodel:ir615scope:eqversion: -

Trust: 0.8

vendor:ruimumodel:ir615 router 2.3.0.r4724scope: - version: -

Trust: 0.6

vendor:ruimumodel:ir615 router 2.3.0.r4870scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-82950 // JVNDB: JVNDB-2021-013886 // NVD: CVE-2021-38484

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-38484
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2021-38484
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-38484
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-82950
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202110-397
value: HIGH

Trust: 0.6

VULMON: CVE-2021-38484
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-38484
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-82950
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-38484
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2021-38484
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.3
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2021-38484
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-82950 // VULMON: CVE-2021-38484 // JVNDB: JVNDB-2021-013886 // CNNVD: CNNVD-202110-397 // NVD: CVE-2021-38484 // NVD: CVE-2021-38484

PROBLEMTYPE DATA

problemtype:CWE-434

Trust: 1.0

problemtype:Unlimited uploads of dangerous types of files (CWE-434) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-013886 // NVD: CVE-2021-38484

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202110-397

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202110-397

PATCH

title:Top Pageurl:https://www.inhandnetworks.com/

Trust: 0.8

title:IR615 Router Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=167809

Trust: 0.6

sources: JVNDB: JVNDB-2021-013886 // CNNVD: CNNVD-202110-397

EXTERNAL IDS

db:NVDid:CVE-2021-38484

Trust: 3.9

db:ICS CERTid:ICSA-21-280-05

Trust: 3.1

db:JVNid:JVNVU94119363

Trust: 0.8

db:JVNDBid:JVNDB-2021-013886

Trust: 0.8

db:CNVDid:CNVD-2021-82950

Trust: 0.6

db:AUSCERTid:ESB-2021.3346

Trust: 0.6

db:CS-HELPid:SB2021100808

Trust: 0.6

db:CNNVDid:CNNVD-202110-397

Trust: 0.6

db:VULMONid:CVE-2021-38484

Trust: 0.1

sources: CNVD: CNVD-2021-82950 // VULMON: CVE-2021-38484 // JVNDB: JVNDB-2021-013886 // CNNVD: CNNVD-202110-397 // NVD: CVE-2021-38484

REFERENCES

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

Trust: 2.9

url:https://nvd.nist.gov/vuln/detail/cve-2021-38484

Trust: 1.4

url:https://jvn.jp/vu/jvnvu94119363/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-21-280-05

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2021.3346

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021100808

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/434.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-82950 // VULMON: CVE-2021-38484 // JVNDB: JVNDB-2021-013886 // CNNVD: CNNVD-202110-397 // NVD: CVE-2021-38484

CREDITS

Ofir Manzur, and Nikolay Sokolik of OTORIO reported these vulnerabilities to CISA., Hay Mizrachi,Haviv Vaizman, Alik Koldobsky

Trust: 0.6

sources: CNNVD: CNNVD-202110-397

SOURCES

db:CNVDid:CNVD-2021-82950
db:VULMONid:CVE-2021-38484
db:JVNDBid:JVNDB-2021-013886
db:CNNVDid:CNNVD-202110-397
db:NVDid:CVE-2021-38484

LAST UPDATE DATE

2024-08-14T13:43:17.825000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-82950date:2021-11-03T00:00:00
db:VULMONid:CVE-2021-38484date:2021-10-22T00:00:00
db:JVNDBid:JVNDB-2021-013886date:2022-09-29T05:46:00
db:CNNVDid:CNNVD-202110-397date:2021-10-29T00:00:00
db:NVDid:CVE-2021-38484date:2021-10-22T15:26:38.713

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-82950date:2021-10-12T00:00:00
db:VULMONid:CVE-2021-38484date:2021-10-19T00:00:00
db:JVNDBid:JVNDB-2021-013886date:2022-09-29T00:00:00
db:CNNVDid:CNNVD-202110-397date:2021-10-07T00:00:00
db:NVDid:CVE-2021-38484date:2021-10-19T13:15:11.457