Inhandnetworks vulnerabilities
Published CVEs affecting Inhandnetworks products: 9 record(s), with severity, exploitation and fixes.
Ir915l-fq39-s Firmware 5Ir912l-fq58 Firmware 5Ir315 Firmware 4Ir302 Firmware 4Ir615 Firmware 4Ir305 Firmware 4
CVE-2026-38718
High · 7.5
CWE-120 Jun 18, 2026
Classic Buffer Overflow in Inhandnetworks Ir915l-fq39-s Firmware
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulnerability in the device registration function. This vulnerability could allow an attacker to cause a denial of service attack on the remote target device.
CVE-2026-38717
Critical · 9.8
CWE-77 Jun 18, 2026
InHand Networks IR912/IR915 routers: root command injection via file upload
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function. The vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
CVE-2026-38716
Critical · 9.8
CWE-77 Jun 18, 2026
InHand Networks IR912 and IR915 Routers: Command Injection in Python App Export
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
CVE-2026-38715
Critical · 9.8
CWE-77 Jun 18, 2026
InHand Networks IR912/IR915 Routers: Root Command Injection in Log Viewing Function
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
CVE-2026-38714
Critical · 9.8
CWE-77 Jun 18, 2026
InHand Networks IR912/IR915 routers: command injection in Python configuration function
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
CVE-2026-38707
Critical · 9.8
CWE-77 May 28, 2026
A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302...
A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
CVE-2026-38704
Critical · 9.8
CWE-77 May 28, 2026
Command Injection in Inhandnetworks Ir315 Firmware
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
CVE-2026-38703
Critical · 9.8
CWE-77 May 28, 2026
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302...
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
CVE-2026-38702
Critical · 9.8
CWE-77 May 28, 2026
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302...
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.