What is the CVSS score of CVE-2026-38702?

CVE-2026-38702 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of InHand IR-Series Routers are affected by CVE-2026-38702?

InHand Networks industrial cellular routers (IR302, IR305, IR315, IR615) contain a critical unpatched vulnerability enabling remote attackers to gain complete device control without authentication.

How to fix or mitigate CVE-2026-38702?

Within 24 hours: Inventory all InHand IR routers in production and document current firmware versions (IR302 V3.5.108 and earlier, IR305/IR315/IR615 V1.0.118 and earlier are affected); identify which devices expose the Admin Access feature to untrusted networks. Within 7 days: Implement firewall rules restricting Admin Access feature access to authorized sources only; disable remote administration if operationally feasible; configure comprehensive logging of all access attempts. Within 30 days: Monitor InHand PSA-2026-05 and vendor advisories for patch release; develop and test firmware update procedures for staged deployment once patches become available.

InHand IR-Series Routers CVE-2026-38702

CRITICAL

Command Injection (CWE-77)

2026-05-28 mitre

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 19:23 vuln.today

CVSS changed

May 28, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

May 28, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

AnalysisAI

Remote root command injection in InHand Networks IR302, IR305, IR315, and IR615 industrial cellular routers allows unauthenticated attackers to execute arbitrary OS commands as root via the Admin Access feature. The flaw affects IR302 V3.5.108, IR305/IR315/IR615 V1.0.118, and earlier firmware, with CVSS 9.8 reflecting network-reachable, no-auth exploitation; no public exploit identified at time of analysis but vendor PSA-2026-05 confirms the issue.

Technical ContextAI

InHand Networks IR302/IR305/IR315/IR615 are industrial cellular/IoT routers commonly deployed in OT, energy, transportation, and remote-site environments where they bridge serial/Ethernet equipment to mobile networks. The defect is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the Admin Access feature accepts attacker-controlled input that is concatenated into an OS-level command invocation without adequate sanitization or argument separation. Because embedded router web/management daemons typically run as root on BusyBox-style Linux, successful command injection yields full device control, including configuration tampering, traffic interception, and pivoting into the routed OT network. The CPE record published with this CVE is a placeholder (cpe:2.3:a:n/a:n/a:*) rather than a properly enumerated hardware/firmware CPE, so automated asset-matching tools may fail to flag affected devices.

RemediationAI

Patch status per vendor advisory: consult InHand PSA-2026-05 (https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf) for the fixed firmware versions for each model, as exact fix versions are not enumerated in the supplied CVE data and should not be invented. Until devices are upgraded, restrict reachability of the Admin Access interface by placing the routers behind a management VLAN or VPN and blocking the management HTTP/HTTPS/Telnet/SSH ports from WAN and untrusted LAN segments - the trade-off is that legitimate remote administration must traverse the new bastion path. Disable WAN-side management entirely if the deployment allows it, and apply ACLs at upstream firewalls to permit management only from known operator IPs; note that any device currently reachable from the internet should be treated as potentially compromised and re-imaged after patching, with credentials and certificates rotated.