CVE-2026-38715: InHand Networks IR912 V1

Synopsis

Command injection in InHand Networks IR912 and IR915 industrial routers (firmware V1.0.0.r20042 and earlier) allows a remote attacker with no authentication to execute arbitrary operating system commands as root. The vulnerability sits in the log viewing function, which fails to sanitize user-supplied input before passing it to a system shell. Successful exploitation gives the attacker full control of the device, including the ability to read all stored data, modify configuration, and disrupt routing services. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's log viewing interface over the network; no physical or local access is needed.

• AuthenticationNot required

  No credentials are required; the vulnerable log viewing function is reachable without logging in.

• Victim interactionNot required

  The attacker sends a crafted request directly to the device; no user action is needed to trigger the injection.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required.

Blast Radius

• The attacker executes arbitrary commands as root, gaining full administrative control of the router's operating system.
• All data stored on the device (logs, credentials, VPN keys, configuration files) is readable by the attacker.
• The attacker can modify routing tables, firewall rules, and interface configuration, redirecting or blocking network traffic.
• The device can be crashed or rebooted at will, disrupting all network services the router provides.