CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
AnalysisAI
Remote root command injection in InHand Networks industrial routers (IR302, IR305, IR315, IR615) allows unauthenticated network attackers to fully compromise affected devices via the WireGuard VPN feature. With CVSS 9.8 and no required privileges or user interaction, this flaw grants attackers ROOT-level control over edge industrial networking equipment. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all affected InHand router models in your network inventory; immediately disable WireGuard VPN features if operationally feasible; implement network segmentation to restrict direct access to affected devices. Within 7 days: Contact InHand Networks support referencing advisory InHand-PSA-2026-05 for guidance on workarounds and patching timeline; document all affected devices and their operational role. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today