CVE-2026-38702: InHand Networks Industrial Routers command injection in Admin Access

CVE-2026-38702 · Severity: info · CVSS 9.8 · Published 2026-05-28

A security vulnerability has been identified in several InHand Networks industrial routers, which are used to provide connectivity for remote industrial equipment. An attacker can exploit this flaw to take complete control of the device with the highest level of administrative access. This could allow an unauthorized party to disrupt network operations, intercept data, or use the router as a foothold to attack other systems on the internal network.

Technologies: InHand Networks IR302 firmware, InHand Networks IR305 firmware, InHand Networks IR315 firmware, InHand Networks IR615 firmware. Vendors: InHand Networks.

Quick answers

Is CVE-2026-38702 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-38702 being exploited in the wild.
How severe is CVE-2026-38702?
Informational severity, with a CVSS score of 9.8, published 28 May 2026.
Which products and versions are affected?
InHand Networks IR302 firmware V3.5.108 and earlier; InHand Networks IR305 firmware V1.0.118 and earlier; InHand Networks IR315 firmware V1.0.118 and earlier; InHand Networks IR615 firmware V1.0.118 and earlier.
Is there a fix for CVE-2026-38702?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38702 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-38702?
Check whether you run InHand Networks IR302 firmware, InHand Networks IR305 firmware, InHand Networks IR315 firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists within the 'Admin Access' feature of multiple InHand Networks router models (IR302, IR305, IR315, and IR615). The flaw is located in the firmware's handling of administrative inputs, where insufficient sanitization allows for the execution of arbitrary system commands. A remote attacker can exploit this vulnerability to bypass security controls and gain full ROOT-level access to the underlying operating system. This enables complete device compromise, including the ability to modify configurations, capture traffic, or pivot to connected local networks. The vulnerability affects IR302 firmware V3.5.108 and earlier, and IR305/IR315/IR615 firmware V1.0.118 and earlier.

Affected products

  • InHand Networks IR302 firmware V3.5.108 and earlier
  • InHand Networks IR305 firmware V1.0.118 and earlier
  • InHand Networks IR315 firmware V1.0.118 and earlier
  • InHand Networks IR615 firmware V1.0.118 and earlier

Timeline

  • 2026-05-28: disclosed: Initial publication of CVE-2026-38702

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.