Otorio

**Name of the Vulnerable Software and Affected Versions** Teltonika’s Remote Management System version 4.14.0 **Description** The issue allows an unauthorized attacker to register previously unregistered devices through the RMS platform. If the `RMS management feature` is enabled, an attacker could register a device to themselves, enabling them to perform different operations on the user's devices. This includes remote code execution with `root` privileges using the `Task Manager` feature on RMS. **Recommendations** For Teltonika’s Remote Management System version 4.14.0, disable the `RMS management feature` to prevent unauthorized device registration. As a temporary workaround, consider restricting access to the `Task Manager` feature on RMS until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Teltonika’s Remote Management System versions prior to 4.10.0 **Description** The issue concerns the use of device serial numbers and MAC addresses for device identification and authentication. If an attacker obtains the serial number and MAC address of a device, they could authenticate as that device, steal its communication credentials, and potentially enable arbitrary command execution as root. This could be achieved by utilizing management options within newly registered devices. **Recommendations** For versions prior to 4.10.0, update to version 4.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to device management options to minimize the risk of exploitation. Additionally, ensure that device serial numbers and MAC addresses are kept confidential to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Teltonika’s Remote Management System versions prior to 4.10.0 **Description** The issue is related to a cross-site scripting (XSS) vulnerability in the main page of the web interface. An attacker with the MAC address and serial number of a connected device could send a maliciously crafted JSON file with an HTML object to trigger the vulnerability. This could allow the attacker to execute scripts in the account context and obtain remote code execution on managed devices. **Recommendations** For versions prior to 4.10.0, update to version 4.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the main page of the web interface until a patch is available. Avoid using the web interface with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Teltonika’s Remote Management System versions prior to 4.10.0 **Description** The issue allows users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL in the Remote Management System cloud subdomain, which could be shared with others without Remote Management System authentication. An attacker could exploit this to create a malicious webpage that uses a trusted and certified domain. The attacker could initiate a reverse shell when a victim connects to the malicious webpage, achieving remote code execution on the victim device. **Recommendations** For versions prior to 4.10.0, update to version 4.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web proxy feature in the Remote Management System until a patch is applied. Additionally, avoid sharing URLs obtained through the web proxy feature with unauthenticated users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542 **Description** The issue is related to improper access control in the software of InHand Networks InRouter 302 and InRouter 615. This allows unauthenticated devices to subscribe to MQTT topics on the same network as the device manager. An unauthorized user who knows of an existing topic name could send and receive messages to and from that topic, including the ability to send GET/SET configuration commands, reboot commands, and push firmware updates. **Recommendations** For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later. As a temporary workaround, consider restricting access to the MQTT topics to prevent unauthorized devices from subscribing to them.

**Name of the Vulnerable Software and Affected Versions** InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542 **Description** The issue is related to the use of insufficiently random values, specifically with the MQTT ClientID parameters, which are not properly randomized. This could allow an unauthorized user to calculate the parameter and gather additional information about other InHand devices managed on the same cloud platform. **Recommendations** For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later to resolve the issue. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later to resolve the issue. As a temporary workaround, consider restricting access to the MQTT ClientID parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542 **Description** The issue is related to improper neutralization of special elements used in an OS command, which could allow an unauthorized user with privileged access to the local web interface or the cloud account managing the affected devices to push a specially crafted configuration update file. This could lead to remote code execution with root privileges. **Recommendations** For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later. As a temporary workaround, consider restricting access to the local web interface and cloud account managing the affected devices to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542 **Description** The issue is related to the use of an unsecured channel for data transmission by default, which may allow a remote attacker to gain unauthorized access to sensitive information or execute arbitrary commands using the MQTT protocol. This could enable an unauthorized user to intercept communication and steal sensitive information, such as configuration information and MQTT credentials, potentially allowing MQTT command injection. **Recommendations** For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later. As a temporary workaround, consider restricting access to the MQTT protocol to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** InHand Networks InRouter 302 versions prior to IR302 V3.5.56 InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542 **Description** The issue is related to the use of a one-way hash with a predictable salt, allowing an unauthorized user to easily calculate the hardcoded string used for encoding MQTT credentials. This could result in the affected devices being temporarily disconnected from the cloud platform, enabling the user to receive MQTT commands with potentially sensitive information. An attacker could exploit this by sending specially crafted HTTP/HTTPS requests using the MQTT protocol, potentially gaining unauthorized access to protected information. **Recommendations** For InHand Networks InRouter 302 versions prior to IR302 V3.5.56, update to version IR302 V3.5.56 or later. For InHand Networks InRouter 615 versions prior to InRouter6XX-S-V2.3.0.r5542, update to version InRouter6XX-S-V2.3.0.r5542 or later. As a temporary workaround, consider restricting access to the MQTT protocol to minimize the risk of exploitation.