CVE-2021-38474

9.8 criticalEPSS 0.7%

Critical (9.8) in inhandnetworks ir615 firmware. EPSS 0.7% chance of exploitation in the next 30 days.

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harming the normal operation of the user. This could allow an attacker to gain valid credentials for the product interface.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2021-10-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

inhandnetworks:ir615_firmware

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05
https://us-cert.cisa.gov/ics/advisories/icsa-21-280-05

Check your stack JSON