CVE-2026-38716: InHand Networks IR912 V1

Synopsis

Command injection in InHand Networks IR912 and IR915 industrial routers (firmware V1.0.0.r20042 and earlier) allows a remote attacker with no authentication to execute arbitrary operating system commands as root via a crafted input to the Python application export function. The vulnerability is reachable over the network without any login credentials or victim interaction, making it trivially exploitable from the internet or any network path to the device. Successful exploitation gives the attacker full root-level control over the affected device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable export function is exposed over the network, so an attacker must be able to reach the device's network interface to send a crafted request.

• AuthenticationNot required

  No credentials or account of any kind are needed; the injection endpoint is accessible without authentication.

• Victim interactionNot required

  The attack is fully automated and does not require any user on the target device to click, open, or approve anything.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• Attacker executes arbitrary operating system commands as root, gaining complete control over the device's firmware and configuration.
• All data stored on or transmitted through the device is readable, including network credentials, VPN keys, and routing tables.
• An attacker can modify device configuration, redirect or intercept network traffic, and persist backdoors across reboots.
• The device can be crashed or rendered unresponsive, disrupting the industrial or operational network segment it serves.