CVE Intelligence
Analysis AI-assisted

CVE-2026-38717: InHand Networks IR912/IR915 routers: root command injection via file upload

CVE-2026-38717 is a command injection flaw (CWE-77) in the file upload function of InHand Networks IR912 and IR915 industrial routers that lets remote attackers run arbitrary commands as root. It is rated critical with a CVSS base score of 9.8. No confirmed exploitation appears in the sources consulted, but exposed devices should be updated and isolated quickly.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-38717 describes a command injection vulnerability (CWE-77) in the file upload function of InHand Networks IR912 and IR915 routers. According to the record, firmware V1.0.0.r20042 and earlier versions are affected, and a remote attacker can supply crafted input that results in arbitrary commands being executed with root privileges. The vendor published a security advisory: InHand PSA-2026-06.

Impact

The CVSS base score is 9.8 (critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This means the flaw is reachable over the network, has low attack complexity, and requires neither privileges nor user interaction. Successful exploitation gives full control of the device as root, with high impact on confidentiality, integrity and availability. Because these routers are typically deployed at the edge of industrial and remote sites, a compromised unit could be used to intercept or alter traffic, disrupt connectivity, or pivot into internal networks (this last point is an inference based on the device role, not a statement from the sources).

Affected products and versions

  • IR912: V1.0.0.r20042 and earlier, per the CVE description.
  • IR915: V1.0.0.r20042 and earlier, per the CVE description.
  • NVD configuration data lists Inhandnetworks IR912L-FQ58 Firmware and Inhandnetworks IR915L-FQ39-S Firmware with versions below 1.0.0.r20044 as affected.

The record does not list an explicit fixed version. The NVD range suggests that 1.0.0.r20044 may be the first unaffected build, but this should be confirmed against the vendor advisory.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Given the unauthenticated, network-reachable nature of the flaw and root-level impact, the risk of future exploitation should be treated as significant.

Remediation and mitigation

  • Review the vendor advisory and upgrade affected IR912 and IR915 devices to the firmware the vendor identifies as fixed.
  • Do not expose the device management interface to the internet; restrict access to trusted management networks or VPNs.
  • Apply firewall rules or ACLs limiting which hosts can reach the web/management services.
  • If a device may have been exposed, consider rotating credentials and reviewing its configuration after upgrading.

Detection guidance

  • Inventory InHand IR912/IR915 devices and record their firmware versions.
  • Check for management interfaces reachable from untrusted networks.
  • Monitor logs and network traffic for unusual file upload requests to the device, unexpected outbound connections, configuration changes or reboots.
  • Treat unexplained processes, new accounts or altered settings on these routers as potential indicators of compromise.

Limitations of the available information

The record does not specify the exact fixed firmware version, the precise upload endpoint or parameter involved, or whether authentication settings change the attack surface in practice beyond the CVSS vector. There is a minor discrepancy between the description (V1.0.0.r20042 and earlier) and the NVD range (below 1.0.0.r20044). No EPSS or SSVC data is available. Consult the vendor advisory for authoritative details.

Frequently asked questions

Which InHand devices are affected by CVE-2026-38717?

The IR912 and IR915 routers running V1.0.0.r20042 and earlier, per the description. NVD lists IR912L-FQ58 and IR915L-FQ39-S firmware below 1.0.0.r20044 as affected.

Is CVE-2026-38717 being exploited in the wild?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a fix?

The record does not list an explicit fixed version. The NVD range suggests 1.0.0.r20044 may be unaffected; confirm with the InHand PSA-2026-06 advisory and upgrade accordingly.

What can I do if I cannot upgrade immediately?

Block internet access to the management interface, restrict it to trusted networks or VPNs, and monitor for unusual upload activity or configuration changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.