CVE-2026-38716: InHand Networks IR912 and IR915 Routers: Command Injection in Python App Export
CVE-2026-38716 is a critical command injection flaw (CWE-77) in the Python application export function of InHand Networks IR912 and IR915 industrial routers. A remote attacker can execute arbitrary commands as root using crafted input. The vulnerability carries a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-38716 is a command injection vulnerability (CWE-77) in the Python application export function of InHand Networks IR912 and IR915 routers. According to the record, firmware V1.0.0.r20042 and earlier versions are affected. Crafted input processed by this function can lead to execution of arbitrary operating system commands with root privileges. The vendor published a security advisory: InHand PSA-2026-06.
Impact
The CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes a network-reachable flaw with low attack complexity, requiring no privileges and no user interaction. Successful exploitation yields root-level command execution, meaning full compromise of confidentiality, integrity and availability of the device. Because these are industrial cellular routers, a compromised unit could plausibly be used to intercept or manipulate traffic, pivot into connected OT or enterprise networks, or disrupt connectivity.
Affected products and versions
- InHand Networks IR912 firmware V1.0.0.r20042 and earlier (NVD lists Ir912l-fq58 Firmware below 1.0.0.r20044)
- InHand Networks IR915 firmware V1.0.0.r20042 and earlier (NVD lists Ir915l-fq39-s Firmware below 1.0.0.r20044)
The NVD configuration bounds suggest that firmware 1.0.0.r20044 is the first non-affected release, but the record does not explicitly list a fixed version. Confirm the remediated build in the vendor advisory.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the critical severity and unauthenticated network vector, exposed devices should still be treated as high priority.
Remediation and mitigation
- Review the vendor advisory and upgrade to the firmware release it identifies as fixed (NVD data points to versions at or above 1.0.0.r20044).
- Do not expose the device's management interfaces to the internet; restrict access to trusted management networks or VPNs.
- Disable the Python application feature if it is not required, where the device allows it.
- Segment industrial routers from sensitive OT and IT assets to limit lateral movement.
- Rotate credentials and review configurations on devices that were exposed before patching.
Detection guidance
- Inventory InHand IR912 and IR915 devices and record their firmware versions.
- Review device and management logs for unexpected use of the Python application export function, particularly from unfamiliar sources.
- Monitor for anomalous outbound connections, new processes, configuration changes or unexpected reboots on the routers.
- Use network monitoring to flag management-plane access from untrusted networks.
Limitations of the available information
The record does not provide technical details about the vulnerable parameter, an explicit fixed version, an EPSS score or SSVC assessment. It is unclear whether the export function is reachable without authentication in every configuration, although the CVSS vector indicates no privileges are required. Product naming differs slightly between the description (IR912/IR915) and NVD configurations (specific IR912L/IR915L models); other model variants may also be affected but are not confirmed here.
Frequently asked questions
What is CVE-2026-38716?
A command injection vulnerability in the Python application export function of InHand Networks IR912 and IR915 routers that lets remote attackers run arbitrary commands as root.
Which firmware versions are affected?
V1.0.0.r20042 and earlier per the description; NVD lists the IR912L-FQ58 and IR915L-FQ39-S firmware below 1.0.0.r20044 as affected.
Is it being exploited?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
How do I fix it?
Apply the fixed firmware identified in InHand's PSA-2026-06 advisory, and restrict network access to device management interfaces.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.