EUVD-2026-37920
GHSA-qfcf-8pf2-288v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote network-reachable file upload with no authentication or user interaction, command injection yielding root execution gives full CIA impact; scope unchanged as code runs within the device OS.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function. The vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
AnalysisAI
Unauthenticated remote command execution affects InHand Networks IR912 and IR915 industrial cellular routers running firmware V1.0.0.r20042 and earlier, where the file upload function fails to sanitize input and passes attacker-controlled data to a shell context. Successful exploitation yields code execution as root on the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the router's web-based file upload function on an IR912 or IR915 running firmware V1.0.0.r20042 or earlier; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed against default-reachable management interfaces. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to severe risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a remotely reachable, low-complexity, unauthenticated path with full CIA impact, and root-level command execution on a network edge device aligns with that scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the Internet or cellular IP ranges for InHand IR912/IR915 web interfaces, then sends a single crafted HTTP request to the file upload endpoint with shell metacharacters embedded in a filename or form field, causing the firmware to execute attacker-supplied commands as root. The attacker uses this primitive to drop a reverse shell or persistent implant, pivot into the OT/SCADA network the router fronts, and use the device as a foothold for further intrusion. … |
| Remediation | Patch availability is not explicitly stated in the structured input, so treat this as 'Patch available per vendor advisory' and consult InHand PSA-2026-06 at https://www.inhand.com/wp-content/uploads/2026/06/InHand-PSA-2026-06_EN.pdf for the exact fixed firmware build and upgrade procedure for IR912 and IR915 units. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all IR912/IR915 routers running firmware V1.0.0.r20042 or earlier in your environment; immediately implement firewall rules blocking external access to these devices and restrict management access to authorized internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-77 – Command Injection
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today