# CVE-2026-38703: InHand Networks IR Series command injection in ZeroTier VPN

Source: https://junglewise.ai/threats/cve-2026-38703-inhand-networks-ir-series-command-injection-in-zerotier-vpn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-38703 · Severity: info · Published 2026-05-28

A security vulnerability has been identified in several InHand Networks industrial routers, specifically within the ZeroTier VPN functionality. This flaw allows a remote attacker to take complete control of the device with the highest level of administrative access (ROOT). Such an exploit could lead to unauthorized access to the internal network, data interception, or a total disruption of the router's operations.

Technologies: [InHand Networks IR302 firmware](https://junglewise.ai/threats/technologies/ir302-firmware), [InHand Networks IR305 firmware](https://junglewise.ai/threats/technologies/ir305-firmware), [InHand Networks IR315 firmware](https://junglewise.ai/threats/technologies/ir315-firmware), [InHand Networks IR615 firmware](https://junglewise.ai/threats/technologies/ir615-firmware). Vendors: [InHand Networks](https://junglewise.ai/threats/vendors/inhand-networks).

## Quick answers

**Is CVE-2026-38703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38703 being exploited in the wild.

**How severe is CVE-2026-38703?** Informational severity, published 28 May 2026.

**Which products and versions are affected?** InHand Networks IR302 firmware V3.5.108 and earlier; InHand Networks IR305 firmware V1.0.118 and earlier; InHand Networks IR315 firmware V1.0.118 and earlier; InHand Networks IR615 firmware V1.0.118 and earlier.

**Is there a fix for CVE-2026-38703?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38703 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-38703?** Check whether you run InHand Networks IR302 firmware, InHand Networks IR305 firmware, InHand Networks IR315 firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the ZeroTier VPN implementation within the firmware of multiple InHand Networks industrial router models. The flaw is located in the handling of ZeroTier configuration or management traffic, where insufficient input validation allows for the execution of arbitrary system commands. An attacker can exploit this over the network to gain unauthorized ROOT-level access to the underlying operating system. Affected models include IR302 (V3.5.108 and earlier), IR305 (V1.0.118 and earlier), IR315 (V1.0.118 and earlier), and IR615 (V1.0.118 and earlier). Users are advised to check for firmware updates from the vendor to mitigate this risk.

## Affected products

- InHand Networks IR302 firmware V3.5.108 and earlier
- InHand Networks IR305 firmware V1.0.118 and earlier
- InHand Networks IR315 firmware V1.0.118 and earlier
- InHand Networks IR615 firmware V1.0.118 and earlier

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory

## References

- [https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf](https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf)

## Related threats

- [InHand Networks Industrial Routers command injection in IPSec VPN](https://junglewise.ai/threats/cve-2026-38707-inhand-networks-industrial-routers-command-injection-in-ipsec-vpn)
- [InHand Networks IR Series command injection in WireGuard VPN](https://junglewise.ai/threats/cve-2026-38704-inhand-networks-ir-series-command-injection-in-wireguard-vpn)
- [InHand Networks Industrial Routers command injection in Admin Access](https://junglewise.ai/threats/cve-2026-38702-inhand-networks-industrial-routers-command-injection-in-admin)