What is the CVSS score of CVE-2026-38715?

CVE-2026-38715 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of InHand IR915 are affected by CVE-2026-38715?

InHand Networks IR912 and IR915 industrial routers (firmware v1.0.0.r20042 and earlier) are vulnerable to remote command execution with root-level privileges through the log viewing function.

How to fix or mitigate CVE-2026-38715?

Within 24 hours, conduct a complete inventory of all deployed IR912 and IR915 devices, identify which are internet-accessible or connected to sensitive networks, and implement enhanced monitoring for suspicious access attempts to the log viewing function. Within 7 days, implement strict network segmentation to isolate affected devices from production systems, restrict administrative access using IP whitelisting and multi-factor authentication, and disable the log viewing function if operationally feasible. Within 30 days, request patch timelines from InHand Networks, evaluate replacement options from alternative vendors, establish a replacement roadmap prioritizing externally-exposed or mission-critical units, and conduct forensic reviews of access logs on all affected devices.

InHand IR915 CVE-2026-38715

EUVD-2026-37918 CRITICAL

Command Injection (CWE-77)

2026-06-18 mitre

GHSA-92wr-794c-2vj6

Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Log-viewing is a management-console feature likely requiring a session, so PR:L rather than PR:N; remote and low-complexity with root command execution gives full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:18 vuln.today

CVE Published

Jun 18, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jun 18, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Remote command injection in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets attackers execute arbitrary OS commands as root through crafted input to the device's log viewing function (CWE-77). The flaw carries a CVSS 9.8 and CISA SSVC rates its technical impact as total and exploitation as automatable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is a modest 1.32% (67th percentile), indicating credible but not yet widespread exploitation pressure.

Technical ContextAI

The affected devices are InHand Networks IR912/IR915 series industrial 3G/4G cellular routers commonly used to connect SCADA, PLC, and remote-telemetry equipment in OT/ICS environments. The vulnerability is a classic CWE-77 command injection: the router's web management 'log viewing' feature passes attacker-controllable input into a shell-style command context without adequate sanitization, so shell metacharacters are interpreted by the underlying OS. Because the router's management daemon runs with root privileges, injected commands inherit full root access to the embedded Linux system. The CPE data supplied is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not enumerate the real product, so affected-product identification relies on the CVE description and InHand's own advisory rather than NVD CPE.

RemediationAI

Patch available per vendor advisory: consult InHand PSA-2026-06 (https://www.inhand.com/wp-content/uploads/2026/06/InHand-PSA-2026-06_EN.pdf) for fixed firmware, as no exact fixed version number is provided in the available intelligence and none should be invented - obtain and apply the corrected firmware directly from InHand. Until patched, remove the router's web management interface from the public Internet and restrict it to a dedicated management VLAN or VPN, since these OT routers should never expose HTTP/HTTPS admin to the WAN; apply firewall ACLs to permit management access only from trusted engineering-workstation IPs, accepting the trade-off of less convenient remote administration. Change default and weak credentials and enforce strong authentication on the web console, and if the log-viewing feature or remote management is not operationally required, disable it. Monitor device logs and upstream firewalls for anomalous command-shell activity as a compensating detection control.