CVE-2026-38703: A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3

Synopsis

A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302, IR305, IR315, and IR615 firmware. The flaw is reachable over the network with no authentication and no victim interaction required, making it trivially exploitable by any remote attacker. Successful exploitation grants the attacker root-level command execution on the affected device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ZeroTier VPN feature is exposed over the network, meaning an attacker must be able to reach the device across the internet or an accessible network segment.

• AuthenticationNot required

  No credentials or prior account access are needed; the vulnerability is exploitable by any unauthenticated remote attacker.

• Victim interactionNot required

  The attacker does not need any action from a user or operator on the target device to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Attacker gains root-level command execution on the affected device, allowing full control of the operating system and all running processes.
• All stored credentials, configuration secrets, and private keys on the device are readable by the attacker.
• The attacker can modify firmware configuration, routing rules, and VPN tunnel settings, disrupting or redirecting network traffic.
• The device can be crashed, rebooted, or rendered permanently inaccessible, causing a full loss of connectivity for any network segment it serves.