CVE-2026-38702: Critical Command Injection in InHand Networks IR-Series Routers

Technical summary

CVE-2026-38702 is a CWE-77 command injection vulnerability in the Admin Access functionality of InHand Networks IR-series industrial routers. The flaw permits unauthenticated remote code execution leading to root-level system compromise. Affected versions include IR302 firmware V3.5.108 and earlier, IR305 firmware V1.0.118 and earlier, IR315 firmware V1.0.118 and earlier, and IR615 firmware V1.0.118 and earlier. The vulnerability's CVSS 3.1 score of 9.8 reflects network accessibility, low attack complexity, lack of privilege requirements, absence of user interaction, and complete impact across confidentiality, integrity, and availability.

Business impact

Compromise of an InHand Networks router via this vulnerability grants attackers full system control, enabling device manipulation, network traffic interception, lateral movement into connected industrial networks, and persistent backdoor installation. For organizations relying on these routers in OT/IoT deployments—common in manufacturing, utilities, and remote site management—successful exploitation can disrupt operations, compromise sensitive process data, and create cascade failures across connected infrastructure. The remote, unauthenticated nature of the attack substantially expands risk surface.

Affected systems

InHand Networks IR302, IR305, IR315, and IR615 industrial routers are affected. Specifically: IR302 firmware V3.5.108 and earlier versions; IR305 firmware V1.0.118 and earlier versions; IR315 firmware V1.0.118 and earlier versions; IR615 firmware V1.0.118 and earlier versions. Verify your device model and current firmware version via the device's management interface or system information page. Organizations should inventory all deployed IR-series routers and cross-reference against these product/version combinations.

Exploitability

This vulnerability presents extremely high exploitability risk. Attack vectors require only network connectivity and do not demand authentication, valid credentials, or user interaction. An attacker can craft and send a malicious command payload to the Admin Access feature to achieve remote code execution as root. The low attack complexity and absence of prerequisite steps make this amenable to rapid weaponization and widespread scanning. No evidence of active exploitation in the wild has been formally disclosed, but the technical accessibility and criticality suggest opportunistic threat actors will target internet-facing devices promptly.

Remediation

Upgrade affected devices to patched firmware versions released by InHand Networks. Verify the exact patched version against the vendor's security advisory for each device model. As an interim measure, restrict network access to the Admin Access feature using firewall rules or access control lists, limiting connections to trusted management networks only. Disable the Admin Access feature if not operationally required. Monitor device logs for suspicious command injection attempts or unauthorized access patterns.

Patch guidance

Contact InHand Networks or consult their official security advisory to obtain patched firmware versions for each affected model (IR302, IR305, IR315, IR615). Firmware updates typically require console or web-based access to the device. Plan maintenance windows to avoid disruption to active industrial processes. Test patches in a non-production environment first if feasible. Verify successful patch application by confirming the new firmware version and re-running vulnerability scans. Given the criticality score, prioritize patching of internet-facing or DMZ-deployed routers first.

Detection guidance

Monitor network traffic for suspicious connections to the Admin Access port on IR-series devices. Implement intrusion detection signatures targeting command injection payloads targeting this vulnerability (consult vendor advisories for indicator patterns). Review device logs and syslog for unexpected command execution, privilege escalation events, or unauthorized administrative access. Deploy endpoint detection tools on management networks that interact with these routers. Hunt for signs of post-exploitation activity such as new user accounts, cron job modifications, or persistent mechanisms. Correlate alerts across your router fleet to identify coordinated or widespread attack attempts.

Why prioritize this

CVE-2026-38702 merits immediate remediation due to its CVSS 9.8 criticality score, complete lack of access controls, remote and unauthenticated attack vector, and potential for wholesale infrastructure compromise. Industrial routers are foundational trust boundaries in OT networks; their compromise enables attacker persistence and lateral movement. The combination of zero friction to exploitation and high business impact places this among the most dangerous vulnerabilities for organizations operating IR-series devices.

Risk score, explained

The CVSS 3.1 score of 9.8 (CRITICAL) reflects: (1) Network Attack Vector—exploitation requires only network access, no physical or local presence; (2) Low Attack Complexity—no special conditions or tools required; (3) No Privileges Required—unauthenticated attackers can trigger the flaw; (4) No User Interaction—attack succeeds without victim action; (5) Unchanged Scope—impact limited to the vulnerable component; (6) High Confidentiality, Integrity, and Availability Impact—successful exploitation grants root access enabling complete system compromise. The only reason the score is not 10.0 is the unchanged scope classification.

Frequently asked questions