CVE-2023-22599
Crypto Weakness in Inhandnetworks Inrouter302 Firmware ≤ 3.5.56
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-22599 is a high-severity Use of a One-Way Hash with a Predictable Salt (CWE-760) vulnerability in Inhandnetworks Inrouter302 Firmware. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26736
Vulnerability Data
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requests from the cloud…
more
platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V6.5.2
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of unpredictable salts and strong password hashing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including proper salting, largely mitigating predictable-salt weaknesses.
Secure development life cycle includes secure coding practices that would catch predictable-salt usage during design and implementation.
A.8.26 only requires that security requirements (including those derived from risk assessment or referencing 8.24 cryptography) be identified and specified; it does not itself mandate, enforce or implement any specific salt-generation mechanism that would stop a predictable salt from being used or exploited.
A.8.27 mandates establishing and applying security engineering principles (including secure-by-design, least privilege, hardening, and reviews against attack patterns) but does not itself mandate or enforce the use of unpredictable salts in one-way password hashing, so the weakness can still be present and exploitable.
Secure coding explicitly prohibits predictable salts and mandates cryptographically secure random salts.
Security testing in development and acceptance can detect weak password hashing implementations.