What is the CVSS score of CVE-2026-38718?

CVE-2026-38718 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of InHand IR915 are affected by CVE-2026-38718?

InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) contain a remote, unauthenticated denial-of-service vulnerability allowing attackers to crash affected…

How to fix or mitigate CVE-2026-38718?

Within 24 hours, identify all InHand Networks IR912 and IR915 routers in your network inventory and verify their firmware version against V1.0.0.r20042 or earlier. Within 7 days, contact InHand Networks to request available firmware updates beyond V1.0.0.r20042, and implement network-level mitigations including firewall rules restricting external access to router management interfaces and network segmentation isolating these devices from untrusted networks. Within 30 days, deploy patched firmware to all affected routers in a staged rollout, or if patches remain unavailable, establish continuous monitoring for unexpected device restarts and maintain compensating network access controls.

InHand IR915 CVE-2026-38718

EUVD-2026-37921 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-18 mitre

GHSA-ph56-37vq-qfxg

Buffer Overflow Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity trigger of the registration service (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:19 vuln.today

CVE Published

Jun 18, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 18, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulnerability in the device registration function. This vulnerability could allow an attacker to cause a denial of service attack on the remote target device.

AnalysisAI

Denial of service in InHand Networks IR912 and IR915 industrial cellular routers (firmware V1.0.0.r20042 and earlier) lets a remote attacker crash the device by overflowing a buffer in the device registration function. Reachable over the network without authentication (CVSS 7.5, AV:N/PR:N), the flaw impacts only availability - no code execution or data exposure is claimed. There is no public exploit identified at time of analysis, and EPSS is low (0.33%, 25th percentile) with CISA SSVC recording exploitation status 'none'.

Technical ContextAI

The affected devices are InHand IR900-series 4G/LTE industrial routers commonly used to connect remote industrial/OT assets to cellular networks. The root cause is CWE-120 (classic buffer copy without size checking) in the firmware's device registration routine - a network-facing handler that copies attacker-controlled input into a fixed-size buffer without validating length, corrupting adjacent memory and crashing the service or device. The CPE record is a placeholder (cpe:2.3:a:n/a:n/a:*), so the exact affected component/service must be taken from the vendor advisory (InHand PSA-2026-06) rather than from structured CPE data.

RemediationAI

Consult InHand's advisory PSA-2026-06 (https://www.inhand.com/wp-content/uploads/2026/06/InHand-PSA-2026-06_EN.pdf) and upgrade IR912/IR915 firmware to the fixed release it specifies; a patch appears to be available per this vendor advisory, but no exact fixed version could be independently confirmed from the provided data, so verify the target build against the PDF before deployment. Because the flaw is network-reachable and unauthenticated, the highest-value compensating control until patched is to remove these routers' management/registration service from public exposure - place them behind a firewall or VPN and restrict inbound access to the registration endpoint to known management servers only (trade-off: legitimate cloud/device-manager check-ins must be explicitly allowlisted or they will break). Additionally, segment the routers onto a dedicated OT management VLAN and rate-limit or block untrusted sources reaching the device's WAN-side services; monitor for unexpected reboots or registration-service crashes as an indicator of exploitation attempts.