InHand Networks IR-Series Routers CVE-2026-38703
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
AnalysisAI
Remote unauthenticated command injection in the ZeroTier VPN feature of InHand Networks IR302, IR305, IR315, and IR615 industrial routers grants ROOT-level code execution on affected devices. The flaw carries a CVSS 9.8 critical rating with no authentication required, exposing industrial network gateways to full compromise; no public exploit identified at time of analysis, but the vendor (InHand Networks PSA-2026-05) has acknowledged the issue.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all affected router models in production; assess whether ZeroTier VPN feature is active and can be disabled. Within 7 days: Implement firewall rules restricting network access to ZeroTier ports to authorized administrative networks only; disable ZeroTier VPN where operationally feasible; contact InHand Networks for patch timeline confirmation (reference PSA-2026-05). …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today