Cyber Resilience

CVE-2021-38462

Critical

Published: 19 October 2021

Published
19 October 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 45.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-38462 is a critical-severity Weak Password Requirements (CWE-521) vulnerability in Inhandnetworks Ir615 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

inhandnetworks
ir615 firmware
2.3.0.r4724, 2.3.0.r4870

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-521

Configuration settings can define and enforce strong password requirements to avoid weak policies.

addresses: CWE-521

IA policy establishes password requirements, directly addressing weak password requirements.

addresses: CWE-521

Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.

addresses: CWE-521

Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.

addresses: CWE-521

Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.

addresses: CWE-521

Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.

addresses: CWE-521

Vulnerability scans assess password policies and weak credential requirements against benchmarks.

addresses: CWE-521

User documentation on maintaining security includes password requirements, directly mitigating weak password policies.

References