EUVD-2026-37919
GHSA-x626-h7w8-hpmr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable command injection into a management feature (AV:N/AC:L/PR:N/UI:N) yielding root execution gives total C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
AnalysisAI
Remote code execution in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets unauthenticated network attackers run arbitrary OS commands as root by abusing the Python application export function, which passes crafted input into a shell context. The flaw carries a CVSS 9.8 and SSVC rates its technical impact as total with automatable exploitation, though it is not yet listed in CISA KEV and no public exploit has been identified; EPSS places exploitation probability at a modest 1.32% (67th percentile).
Technical ContextAI
The affected devices are InHand Networks IR912 and IR915 industrial IoT/cellular edge routers used to connect field equipment to enterprise or cloud networks. These routers expose a management feature that lets operators export a Python application; the export routine constructs and executes an OS-level command incorporating attacker-influenced input without adequate sanitization. This maps to CWE-77 (Improper Neutralization of Special Elements used in a Command / 'Command Injection'), where injected shell metacharacters break out of the intended command and execute additional commands. Because the router firmware runs the web/management stack with root privileges, injected commands inherit full root context. The CPE provided by the source is a placeholder ('cpe:2.3:a:n/a:n/a') and does not identify the products, so affected-product identification relies on the CVE description and the InHand PSA advisory rather than structured NVD CPE data.
RemediationAI
Consult InHand PSA-2026-06 (https://www.inhand.com/wp-content/uploads/2026/06/InHand-PSA-2026-06_EN.pdf) for the vendor-supplied fixed firmware and upgrade both IR912 and IR915 devices beyond V1.0.0.r20042; the input data does not include an exact fixed build number, so Patch available per vendor advisory but the specific patched version must be taken from the PSA and is not independently confirmed here. Until firmware is applied, reduce exposure by restricting access to the router's management/web interface to a trusted management VLAN or VPN and blocking it from WAN/cellular-facing interfaces (trade-off: remote administration must then go through the VPN), and disable or restrict access to the Python application export feature if the deployment does not require it (trade-off: loss of that management capability). Additionally, place the devices behind a firewall that filters inbound management traffic and monitor for anomalous command execution, recognizing these are compensating controls that lower reachability but do not remove the underlying injection flaw.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today