CVE Intelligence
Analysis AI-assisted

CVE-2026-38715: InHand Networks IR912/IR915 Routers: Root Command Injection in Log Viewing Function

CVE-2026-38715 is a command injection flaw (CWE-77) in the log viewing function of InHand Networks IR912 and IR915 industrial routers that lets remote attackers run arbitrary commands as root. It carries a CVSS 3.1 score of 9.8 (critical), and the vendor has published a security advisory.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-38715 affects the InHand Networks IR912 and IR915 cellular/industrial routers. According to the CVE description, the log viewing function fails to safely handle input, allowing command injection (CWE-77). A remote attacker who supplies crafted input can have arbitrary commands executed with root privileges on the device. The record was published on 2026-06-18 and has NVD status "Analyzed".

Impact

The CVSS 3.1 base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability. Root-level command execution on an edge router could allow full device takeover, traffic interception or manipulation, persistence, and use of the router as a pivot into connected operational or corporate networks.

Affected products and versions

  • IR912 and IR915 firmware V1.0.0.r20042, including earlier versions (per the CVE description).
  • NVD configuration data lists Inhandnetworks Ir912l-fq58 Firmware and Inhandnetworks Ir915l-fq39-s Firmware with versions earlier than 1.0.0.r20044.

Other hardware variants of the IR900 family are not named in the record; check the vendor advisory for the exact model list.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the low attack complexity and lack of required authentication indicated by the CVSS vector, the flaw should nonetheless be treated as a high priority.

Remediation and mitigation

  • Review the vendor's security advisory: InHand PSA-2026-06.
  • The record does not list an explicit fixed release, but the affected range (earlier than 1.0.0.r20044) suggests that firmware 1.0.0.r20044 or later addresses the issue; confirm this with the advisory before deploying.
  • Until patched, restrict access to the router's web/management interface to trusted management networks or VPNs, and never expose it to the internet.
  • Enforce strong administrative credentials and disable unused remote management services.
  • Segment routers from critical OT/IT assets to limit the blast radius of a compromise.

Detection guidance

  • Inventory InHand IR912/IR915 devices and record their firmware versions.
  • Review management-interface access logs for unexpected requests to log viewing features, especially from untrusted sources or with unusual parameter content.
  • Watch for anomalous outbound connections, configuration changes, new accounts, or unexpected processes on the routers.
  • Use network monitoring to flag management traffic to these devices originating outside approved administrative hosts.

Limitations of the available information

  • The record contains no explicit fix entry; the fixed version is inferred from the affected version range.
  • The record does not state whether authentication is truly bypassed in all configurations beyond what the CVSS vector expresses.
  • No EPSS or SSVC data is available, and the full list of affected models may be broader than the two firmware products listed in NVD.

Frequently asked questions

What is CVE-2026-38715?

A command injection vulnerability in the log viewing function of InHand Networks IR912 and IR915 routers that lets remote attackers execute arbitrary commands as root.

Which versions are affected?

Firmware V1.0.0.r20042 and earlier per the description; NVD lists Ir912l-fq58 and Ir915l-fq39-s firmware versions earlier than 1.0.0.r20044.

Is it being exploited in the wild?

It is not in the CISA KEV catalog and no confirmed exploitation appears in the sources consulted.

How should I remediate it?

Follow the InHand PSA-2026-06 advisory and update to a fixed firmware (likely 1.0.0.r20044 or later, to be confirmed with the vendor), and restrict management interface access to trusted networks.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.