CVE-2021-38474

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. This could allow an attacker to gain valid credentials for the product interface.

• CWE-307
• CWE-307

• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05Third Party Advisory, US Government Resource

Published

Oct 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38469Many of the services used by the affected product do not spe…7.1
• CVE-2021-3847An unauthorized access to the execution of the setuid file w…7.8
• CVE-2021-38470InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…9.1
• CVE-2021-38471There are multiple API function codes that permit data writi…9.1
• CVE-2021-38472InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…4.7
• CVE-2021-38473The affected product’s code base doesn’t properly control ar…8.8
• CVE-2021-38475The database connection to the server is performed by callin…8.8
• CVE-2021-38476InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…5.3
• CVE-2021-38477There are multiple API function codes that permit reading an…9.8
• CVE-2021-38478InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.…9.1
• CVE-2021-38479Many API function codes receive raw pointers remotely from t…7.5
• CVE-2021-3848An arbitrary file creation by privilege escalation vulnerabi…5.5