CVE-2023-5570 Inohom CVE debrief

Who should care

Organizations running Inohom Home Manager Gateway, especially administrators and security teams responsible for exposed or remotely reachable deployments. Because the CVSS vector is network-based and requires no privileges or user interaction, this should be treated as a priority issue for any affected instance before 1.27.12.

Technical summary

The supplied NVD record identifies the affected CPE as inohom:home_manager_gateway with vulnerable versions ending before 1.27.12. The issue is categorized as improper protection for outbound error messages and alert signals and mapped to CWE-1320 in advisory metadata. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating remote exploitation with high confidentiality impact and no integrity or availability impact in the provided record.

Defensive priority

High. The vulnerability is remotely reachable, requires no privileges, and may expose account-related information. Version-based remediation is straightforward, so upgrading or otherwise removing exposure should be prioritized.

Recommended defensive actions

• Upgrade Inohom Home Manager Gateway to version 1.27.12 or later.
• Inventory all deployments and confirm no affected versions remain in production or test environments.
• Treat any exposed instance as a priority for remediation because the issue is network-exploitable and requires no authentication.
• Review surrounding security logs and alerting for repeated responses or patterns consistent with account enumeration attempts.
• Track the CVE record and the linked USOM advisory for any additional vendor guidance or clarifications.

Evidence notes

The evidence corpus includes the official CVE record and NVD detail page, plus USOM reference links. NVD metadata shows the vulnerable CPE cpe:2.3:a:inohom:home_manager_gateway:*:*:*:*:*:*:*:* with versionEndExcluding 1.27.12. The supplied references also point to USOM advisory pages for this CVE. No exploit details were used or inferred beyond the published description and CVSS metadata.

Official resources