CVE-2026-38703
Command Injection in InHand Networks IR Series Firmware
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| inhand_networks | ir302 | 3.5.108 |
| inhand_networks | ir305 | 1.0.118 |
| inhand_networks | ir315 | 1.0.118 |
| inhand_networks | ir615 | to 3.5.108 (exc) |
| inhand_networks | ir615 | to 1.0.118 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw found in the ZeroTier VPN feature of certain InHand Networks devices running specific firmware versions. It allows attackers to execute arbitrary commands on the affected device.
By exploiting this vulnerability, an attacker can gain ROOT privileges on the remote target device, meaning they can fully control the device at the highest permission level.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to take complete control over the affected device by obtaining ROOT privileges remotely.
This could lead to unauthorized access, manipulation, or disruption of device operations, potentially compromising the security and functionality of the network or systems relying on these devices.