Critical · published January 12, 2023
🚨 Unsecured MQTT topics are an open invitation! Any unauthorized device can join the conversation and wreak havoc—think of it as a party where anyone can walk in and start making changes without an RSVP! 🔥 Imagine a conference room where anyone can walk in and start speaking without any credentials. Now, picture someone making announcements or even changing the entire agenda without anyone stopping them—it’s complete chaos! With this vulnerability, an attacker could send GET/SET configuration commands, reboot devices, and even push malicious firmware updates. This could lead to system outages or even complete control of sensitive network devices, leaving your infrastructure vulnerable and out of your control.
Imagine a conference room where anyone can walk in and start speaking without any credentials. Now, picture someone making announcements or even changing the entire agenda without anyone stopping them—it’s complete chaos! This vulnerability in InHand Networks' InRouter 302 and 615 models allows unauthorized devices to subscribe to MQTT topics, enabling them to send and receive messages as if they were legitimate users on the same network.
With this vulnerability, an attacker could send GET/SET configuration commands, reboot devices, and even push malicious firmware updates. This could lead to system outages or even complete control of sensitive network devices, leaving your infrastructure vulnerable and out of your control. Update to IR302 V3.5.56 for the InRouter 302 and InRouter6XX-S-V2.3.0.r5542 for the InRouter 615 immediately! Additionally, implement proper access controls to ensure only authenticated users can access MQTT topics. 🛡️ You've got this! Follow these steps, and you'll regain control over your network in no time! 💪✨