CVE-2026-38714: InHand Networks IR912/IR915 routers: command injection in Python configuration function
CVE-2026-38714 is a command injection flaw (CWE-77) in the Python configuration function of InHand Networks IR912 and IR915 industrial routers. A remote attacker can run arbitrary commands as root using crafted input, and NVD rates it 9.8 (critical). No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-38714 affects the InHand Networks IR912 and IR915 routers. According to the record, firmware V1.0.0.r20042 and earlier contains a command injection weakness (CWE-77) in the device's Python configuration function. Crafted input passed to this function can lead to arbitrary command execution with root privileges. The vendor published a security advisory covering the issue: InHand PSA-2026-06.
Impact
NVD assigns a base score of 9.8 (critical), with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Successful exploitation would give an attacker full control of the router, allowing traffic interception, configuration tampering, persistence, or use of the device as a pivot into the networks it connects, which is especially sensitive in industrial and remote-site deployments.
Affected products and versions
- IR912 (NVD CPE: Ir912l-fq58 Firmware): versions earlier than 1.0.0.r20044
- IR915 (NVD CPE: Ir915l-fq39-s Firmware): versions earlier than 1.0.0.r20044
The description explicitly names V1.0.0.r20042 and earlier as vulnerable. The NVD range suggests 1.0.0.r20044 is the first non-affected release, but the record does not list a fix explicitly; confirm against the vendor advisory.
Exploitation status
The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the unauthenticated, network-reachable nature described by the CVSS metrics, exposed devices should be treated as high priority regardless.
Remediation and mitigation
- Review the vendor advisory and upgrade to the firmware it recommends; per NVD data, builds from 1.0.0.r20044 onward fall outside the affected range.
- Do not expose the router's management interfaces to the internet; restrict access to trusted management networks or VPNs.
- Apply firewall rules or ACLs limiting who can reach configuration services.
- After patching, review device configuration and credentials for unauthorized changes, and rotate credentials if compromise is suspected.
Detection guidance
- Inventory InHand IR912/IR915 devices and record their firmware versions.
- Monitor access logs for management or configuration requests from unexpected sources.
- Watch for unexpected configuration changes, new accounts, unusual outbound connections or reboots originating from the routers.
- Use network monitoring to flag management traffic reaching these devices from untrusted segments.
Limitations of the available information
The record does not describe which interface or service exposes the Python configuration function, nor whether authentication is required in practice beyond what the CVSS vector implies. No explicit fixed version is listed in the record's fix data, no EPSS or SSVC data is available, and the exact product variant naming differs between the description and the NVD configuration data.
Frequently asked questions
Which devices are affected by CVE-2026-38714?
InHand Networks IR912 and IR915 routers running V1.0.0.r20042 and earlier; NVD lists firmware earlier than 1.0.0.r20044 as affected.
Is CVE-2026-38714 being actively exploited?
It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
How should I remediate it?
Follow the InHand PSA-2026-06 advisory to update firmware, and restrict access to management interfaces to trusted networks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.