Critical severity · published May 28, 2026
CVE-2026-38702
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware…
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ir302 Firmware · Inhandnetworks
before 3.5.112 · source: NVD
IF
Ir305 Firmware · Inhandnetworks
before 1.0.121 · source: NVD
IF
Ir315 Firmware · Inhandnetworks
before 1.0.121 · source: NVD
IF
Ir615 Firmware · Inhandnetworks
before 1.0.121 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-38702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-38702
Vendor Advisory
https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf
More from Ir302 Firmware
9.8
CVE-2026-38703
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware…
9.8
CVE-2026-38707
A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware…
9.8
CVE-2026-38704
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware…
8.8
CVE-2022-30543
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45
8.8
CVE-2022-28689
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45