What is the CVSS score of EUVD-2026-37920?

EUVD-2026-37920 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of InHand IR912/IR915 are affected by EUVD-2026-37920?

InHand Networks IR912 and IR915 cellular routers (firmware V1.0.0.r20042 and earlier) contain a critical vulnerability allowing external attackers to gain complete administrative control of affected…

How to fix or mitigate EUVD-2026-37920?

24 hours: Identify all IR912/IR915 routers running firmware V1.0.0.r20042 or earlier in your environment; immediately implement firewall rules blocking external access to these devices and restrict management access to authorized internal networks only. 7 days: Contact InHand Networks to confirm availability of patched firmware and expected release timeline; initiate procurement planning for replacement devices if patches remain unavailable; document all affected routers, their network location, and operational criticality. 30 days: Deploy vendor-released patch (monitor InHand Networks advisories for firmware version V1.0.0.r20043 or later) to all identified routers; replace any devices that remain unpatched; implement network segmentation to isolate affected routers from critical operational technology systems and enterprise networks.

InHand IR912/IR915 EUVD-2026-37920

| CVE-2026-38717 CRITICAL

Command Injection (CWE-77)

2026-06-18 mitre

GHSA-qfcf-8pf2-288v

Command Injection File Upload N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote network-reachable file upload with no authentication or user interaction, command injection yielding root execution gives full CIA impact; scope unchanged as code runs within the device OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 19:40 vuln.today

CVSS changed

Jun 18, 2026 - 19:38 NVD

9.8 (CRITICAL)

CVE Published

Jun 18, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function. The vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Unauthenticated remote command execution affects InHand Networks IR912 and IR915 industrial cellular routers running firmware V1.0.0.r20042 and earlier, where the file upload function fails to sanitize input and passes attacker-controlled data to a shell context. Successful exploitation yields code execution as root on the device. No public exploit identified at time of analysis, but the CVSS 9.8 rating and network-reachable file upload endpoint make this a high-priority patching target for any operator with these routers exposed to untrusted networks.

Technical ContextAI

InHand IR912 and IR915 are 3G/4G industrial cellular routers commonly deployed at the edge of OT and IoT environments for remote site connectivity, SCADA backhaul, and M2M applications. The flaw is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the firmware's web-based file upload handler incorporates user-supplied input (likely a filename, path parameter, or metadata field) into a shell or system() style invocation without proper neutralization of shell metacharacters. The CPE record in NVD is a placeholder ('cpe:2.3:a:n/a:n/a:*'), so authoritative product/version identification relies on the InHand PSA-2026-06 advisory rather than NVD enumeration.

RemediationAI

Patch availability is not explicitly stated in the structured input, so treat this as 'Patch available per vendor advisory' and consult InHand PSA-2026-06 at https://www.inhand.com/wp-content/uploads/2026/06/InHand-PSA-2026-06_EN.pdf for the exact fixed firmware build and upgrade procedure for IR912 and IR915 units. Until devices are upgraded, restrict access to the router's web management and file upload endpoints to a trusted management VLAN or jump host using ACLs on the WAN/cellular interface, disable remote (Internet-facing) HTTP/HTTPS administration if not strictly required, and place the routers behind a firewall that blocks inbound connections to the management ports - note that these controls break legitimate remote provisioning workflows and any cloud-management agent that reaches the device from outside the trusted segment. Monitor router logs for unexpected file upload POST requests and outbound connections that could indicate post-exploitation activity.