What is the CVSS score of CVE-2026-38714?

CVE-2026-38714 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

How to fix or mitigate CVE-2026-38714?

Within 24 hours: conduct inventory of all IR912 and IR915 devices in your environment and assess network exposure to determine which devices can be accessed remotely; contact InHand Networks immediately to confirm patch availability timelines. Within 7 days: deploy network segmentation to restrict management interface access (SSH, HTTP/HTTPS) to these devices, limiting connectivity to authorized administrative networks only; implement enhanced monitoring for suspicious command execution patterns. Within 30 days: establish a staged deployment plan for vendor patches when released, prioritizing devices in production environments with external network access.

Python CVE-2026-38714

EUVD-2026-37917 CRITICAL

Command Injection (CWE-77)

2026-06-18 mitre

GHSA-3377-mfxj-gx66

Python Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:18 vuln.today

CVE Published

Jun 18, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jun 18, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets remote attackers run arbitrary operating-system commands as root through the device's Python configuration function. CISA's SSVC framework rates the technical impact as total and the flaw as automatable, and the CVSS 9.8 score reflects full compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis, and the EPSS probability sits at a modest 1.32% (67th percentile).