CVE-2023-22599

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They  send MQTT credentials in response to HTTP/HTTPS requests from the cloud platform. These credentials are encoded using a hardcoded string into an MD5 hash. This string could be easily calculated by an unauthorized user who spoofed sending an HTTP/HTTPS request to the devices. This could result in the affected devices being temporarily disconnected from the cloud platform and allow the user to receive MQTT commands with potentially sensitive information.

• CWE-760

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03Third Party Advisory, US Government Resource
• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03Third Party Advisory, US Government Resource

Published

Jan 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22592 IBM Robotic Process Automation for Cloud Pak 21.0.1 through…7.8
• CVE-2023-22593 IBM Robotic Process Automation for Cloud Pak 21.0.1 through…7.8
• CVE-2023-22594IBM Robotic Process Automation for Cloud Pak 20.12.0 through…5.4
• CVE-2023-22595IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterp…5.4
• CVE-2023-22597 InHand Networks InRouter 302, prior to version IR302 V3.5.5…5.9
• CVE-2023-22598 InHand Networks InRouter 302, prior to version IR302 V3.5.5…7.2
• CVE-2023-2260Authorization Bypass Through User-Controlled Key in GitHub r…8.8
• CVE-2023-22600 InHand Networks InRouter 302, prior to version IR302 V3.5.5…8.1
• CVE-2023-22601 InHand Networks InRouter 302, prior to version IR302 V3.5.5…8.6
• CVE-2023-22602When using Apache Shiro before 1.11.0 together with Spring B…7.5
• CVE-2023-22603Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22604Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…