InHand IR-Series Routers CVE-2026-38702
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
AnalysisAI
Remote root command injection in InHand Networks IR302, IR305, IR315, and IR615 industrial cellular routers allows unauthenticated attackers to execute arbitrary OS commands as root via the Admin Access feature. The flaw affects IR302 V3.5.108, IR305/IR315/IR615 V1.0.118, and earlier firmware, with CVSS 9.8 reflecting network-reachable, no-auth exploitation; no public exploit identified at time of analysis but vendor PSA-2026-05 confirms the issue.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all InHand IR routers in production and document current firmware versions (IR302 V3.5.108 and earlier, IR305/IR315/IR615 V1.0.118 and earlier are affected); identify which devices expose the Admin Access feature to untrusted networks. Within 7 days: Implement firewall rules restricting Admin Access feature access to authorized sources only; disable remote administration if operationally feasible; configure comprehensive logging of all access attempts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today