CVE-2023-22600

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same network as the device manager. An unauthorized user who knows of an existing topic name could send and receive messages to and from that topic. This includes the ability to send GET/SET configuration commands, reboot commands, and push firmware updates.

• CWE-284

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03Third Party Advisory, US Government Resource
• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-03Third Party Advisory, US Government Resource

Published

Jan 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22594IBM Robotic Process Automation for Cloud Pak 20.12.0 through…5.4
• CVE-2023-22595IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterp…5.4
• CVE-2023-22597 InHand Networks InRouter 302, prior to version IR302 V3.5.5…5.9
• CVE-2023-22598 InHand Networks InRouter 302, prior to version IR302 V3.5.5…7.2
• CVE-2023-22599 InHand Networks InRouter 302, prior to version IR302 V3.5.5…9.1
• CVE-2023-2260Authorization Bypass Through User-Controlled Key in GitHub r…8.8
• CVE-2023-22601 InHand Networks InRouter 302, prior to version IR302 V3.5.5…8.6
• CVE-2023-22602When using Apache Shiro before 1.11.0 together with Spring B…7.5
• CVE-2023-22603Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22604Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22605Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22606Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…