---
id: CVE-2026-38707
title: >-
  A command injection vulnerability exists in the IPSec VPN feature of InHand
  Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware
  V1.0.118, IR615 firmware V1.0.118, and earlier versions
summary: >-
  A command injection vulnerability exists in the IPSec VPN feature of InHand
  Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware
  V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit
  this vul…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-77
vendor: inhandnetworks
product: ir315_firmware
affected:
  - ir315_firmware < 1.0.121
  - ir302_firmware < 3.5.112
  - ir615_firmware < 1.0.121
  - ir305_firmware < 1.0.121
patched:
  - ir315_firmware 1.0.121
  - ir302_firmware 3.5.112
  - ir615_firmware 1.0.121
  - ir305_firmware 1.0.121
published: '2026-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-38707'
references:
  - url: 'https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.01767
epssPercentile: 0.77647
ingestedAt: '2026-10-14T20:53:12.339Z'
---

## Overview

A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

## Affected

- `ir315_firmware < 1.0.121`
- `ir302_firmware < 3.5.112`
- `ir615_firmware < 1.0.121`
- `ir305_firmware < 1.0.121`

## Remediation

Upgrade past the affected range:

- `ir315_firmware 1.0.121`
- `ir302_firmware 3.5.112`
- `ir615_firmware 1.0.121`
- `ir305_firmware 1.0.121`