CVE-2026-38702: A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3

Synopsis

A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302, IR305, IR315, and IR615 router firmware. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any attacker who can reach the device's admin interface can send a crafted request. Successful exploitation gives the attacker root-level command execution on the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Admin Access interface is exposed over the network, so an attacker must be able to reach the device's admin endpoint to exploit it.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is exploitable by an unauthenticated remote attacker.

• Victim interactionNot required

  No user action on the target device is needed; the attacker sends a crafted request directly without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or non-default configuration.

Blast Radius

• A successful attacker gains root-level command execution on the affected InHand Networks device, giving full control over the operating system and all running processes.
• The attacker can read all data stored or passing through the device, including network credentials, VPN keys, and any configuration secrets held in firmware.
• The attacker can modify device configuration, routing tables, firewall rules, or firmware, enabling persistent backdoors or traffic interception.
• The attacker can crash or reboot the device at will, disrupting network connectivity for any infrastructure that depends on it.