CVE-2026-38704: A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3

Synopsis

A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302, IR305, IR315, and IR615 industrial router firmware. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable from the internet. Successful exploitation gives an attacker root-level command execution on the affected device. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment a fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable WireGuard VPN feature is exposed over the network, so an attacker must be able to reach the device's network interface to send a malicious request.

• AuthenticationNot required

  No credentials of any kind are needed; the injection point is accessible without prior authentication.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or administrator on the target device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment.

Blast Radius

• An attacker gains root-level command execution on the affected router, giving full control over the operating system and all running processes.
• All data passing through or stored on the device is readable, including VPN configuration secrets, credentials, and traffic logs.
• An attacker can modify routing rules, firewall policy, VPN tunnels, or any persisted configuration on the device.
• The device can be crashed, rebooted, or rendered permanently unavailable, disrupting all network traffic it routes.