CVE-2026-38714: InHand Networks IR912 V1

Synopsis

Command injection in InHand Networks IR912 and IR915 routers (firmware V1.0.0.r20042 and earlier) allows a remote, unauthenticated attacker to execute arbitrary operating system commands as root via a crafted input to the Python configuration function. The vulnerability is reachable over the network with no authentication or user interaction required, giving an attacker full control of the device, including read and write access to all data and the ability to disrupt service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Python configuration function is exposed over the network, so an attacker must be able to reach the device's network interface to send a crafted request.

• AuthenticationNot required

  No account or credentials of any privilege level are needed to trigger the command injection.

• Victim interactionNot required

  The attack is fully remote and automated; no user on the target device needs to take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental prerequisites required.

Blast Radius

• A successful attacker executes arbitrary OS commands as root, gaining complete control over the device's operating system.
• All data stored on or transmitted through the device is readable by the attacker, including credentials, configuration secrets, and network traffic.
• The attacker can modify any persisted configuration, routing rules, or firmware state on the device.
• The attacker can crash or restart the device at will, disrupting all network traffic and services it routes.