CVE-2026-38718: InHand IR912/IR915 Buffer Overflow Denial of Service

Technical summary

CVE-2026-38718 is a classic stack or heap-based buffer overflow (CWE-120) in the device registration function of InHand industrial gateways. The vulnerability exists because the registration handler does not properly validate the length of user-supplied input before copying it into a fixed-size buffer. An attacker can craft a registration request with an oversized payload to corrupt memory, overwrite function pointers or return addresses, and crash the process. The CVSS 3.1 score of 7.5 (HIGH) reflects the high availability impact and ease of exploitation (network-accessible, no privileges required, no user interaction).

Business impact

IR912 and IR915 devices are commonly deployed as edge gateways in industrial, remote-site, and branch office environments for cellular connectivity and WAN failover. A successful denial-of-service attack via this vulnerability could interrupt critical connectivity, halt remote monitoring and control operations, and force emergency maintenance or device replacement. In mission-critical deployments (utilities, manufacturing, emergency response), even brief unavailability can have cascading operational consequences.

Affected systems

The vulnerability affects InHand Networks IR912 and IR915 devices running firmware version 1.0.0.r20042 and all earlier versions. Specifically affected models include IR912L-FQ58 and IR915L-FQ39-S. Verify your device firmware version and model against InHand's advisory to confirm exposure. Devices running patched versions after 1.0.0.r20042 are not affected.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no special privileges, and no user interaction. Any attacker with network access to the device's registration interface can trigger the buffer overflow. No exploit code has been observed in the wild as of the publication date, but the simplicity of buffer overflow exploitation makes weaponization trivial. The device is designed for remote management, making it likely to be internet-facing in many deployments.

Remediation

InHand Networks has released patched firmware for both affected models. Organizations should immediately identify all IR912 and IR915 devices in their inventory, verify current firmware versions, and apply vendor patches as soon as operationally feasible. Firmware updates should be validated in a non-production environment first to ensure compatibility with existing configurations and integrations. Given the high exploitability and availability impact, patches should be prioritized for internet-facing or publicly routable devices.

Patch guidance

Obtain the latest firmware from InHand Networks' support portal or your authorized reseller. The patched version will be explicitly noted in the security advisory with a version number higher than 1.0.0.r20042. Follow InHand's documented firmware upgrade procedure, which typically involves downloading the image, backing up device configuration, and initiating a controlled reboot. Some deployments may require coordinated maintenance windows or redundancy measures. Test patches in a representative lab environment before mass deployment.

Detection guidance

Monitor device logs for registration requests with abnormally large payloads or malformed registration protocol messages that precede device crashes or reboots. Network intrusion detection systems (IDS) can flag oversized registration frames or repeated failed registration attempts. Check for unexpected device unavailability or spontaneous reboots in your IR912/IR915 fleet, which may indicate exploitation attempts. Enable syslog forwarding and centralize device event logs to establish a baseline of normal registration traffic and identify anomalies.

Why prioritize this

This vulnerability merits urgent attention despite not yet being included in CISA's Known Exploited Vulnerabilities (KEV) catalog. The combination of high CVSS score (7.5), complete absence of authentication barriers, trivial exploitability of buffer overflows, and the typical internet-facing deployment of these industrial gateways creates a compelling exploitation incentive. The availability impact aligns with disruptive attack objectives. Early patching reduces risk substantially before the vulnerability gains wider attention or is added to public exploit databases.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible denial-of-service condition with no authentication, low complexity, and no user interaction required. The attack vector is Network (AV:N), access complexity is Low (AC:L), privileges required is None (PR:N), user interaction is None (UI:N), and scope is Unchanged (S:U). The impact is purely on availability (A:H) with no confidentiality or integrity compromise, which caps the score below critical severity. However, the accessibility and ease of exploitation elevate concern in practice.

Frequently asked questions