CVE-2026-38707: InHand Networks Industrial Routers command injection in IPSec VPN

CVE-2026-38707 · Severity: info · Published 2026-05-28

A security vulnerability has been identified in several InHand Networks industrial routers, which are used to provide secure remote connectivity for industrial equipment. An attacker can exploit a flaw in the VPN feature to take complete control of the device with the highest level of administrative access (ROOT). This could allow an unauthorized user to disrupt network traffic, access sensitive data, or use the router as a foothold to attack other systems on the internal network.

Technologies: InHand Networks IR302 firmware, InHand Networks IR305 firmware, InHand Networks IR315 firmware, InHand Networks IR615 firmware. Vendors: InHand Networks.

Quick answers

Is CVE-2026-38707 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-38707 being exploited in the wild.
How severe is CVE-2026-38707?
Informational severity, published 28 May 2026.
Which products and versions are affected?
InHand Networks IR302 firmware V3.5.108 and earlier; InHand Networks IR305 firmware V1.0.118 and earlier; InHand Networks IR315 firmware V1.0.118 and earlier; InHand Networks IR615 firmware V1.0.118 and earlier.
Is there a fix for CVE-2026-38707?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38707 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-38707?
Check whether you run InHand Networks IR302 firmware, InHand Networks IR305 firmware, InHand Networks IR315 firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists within the IPSec VPN implementation of InHand Networks IR302, IR305, IR315, and IR615 routers. The flaw is located in the firmware's handling of VPN configurations, where insufficient input validation allows for the execution of arbitrary system commands. A remote attacker can exploit this vulnerability to bypass security controls and gain ROOT-level access to the underlying operating system. The vulnerability affects IR302 firmware V3.5.108, and IR305, IR315, and IR615 firmware V1.0.118 and earlier versions. Users are advised to check for firmware updates from the vendor to mitigate this risk.

Affected products

  • InHand Networks IR302 firmware V3.5.108 and earlier
  • InHand Networks IR305 firmware V1.0.118 and earlier
  • InHand Networks IR315 firmware V1.0.118 and earlier
  • InHand Networks IR615 firmware V1.0.118 and earlier

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.