CVE-2026-38707: A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3

Synopsis

A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302, IR305, IR315, and IR615 firmware (IR302 V3.5.108, IR305/IR315/IR615 V1.0.118, and earlier). The flaw is reachable over the network with no authentication required and no user interaction needed, making it exploitable by any attacker who can reach the affected device. Successful exploitation gives the attacker root-level command execution on the target device, enabling full system compromise including data access, configuration tampering, and service disruption. No fix version has been published; HarborGuard tracks the advisory and will surface a patched rebuild as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable IPSec VPN feature is exposed over the network, meaning an attacker must be able to reach the device's network interface to deliver a malicious payload.

• AuthenticationNot required

  No credentials or prior account access are needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a user or administrator on the target device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• Attacker gains a root shell on the target device, with full control over all processes and files.
• All stored credentials, VPN configuration secrets, and network traffic passing through the device are readable.
• Device configuration can be modified, including routing tables, firewall rules, and VPN tunnel definitions.
• The device can be crashed, rebooted, or enrolled into a botnet, disrupting all traffic it handles.