CVE-2026-38717: InHand Networks IR912 V1

Synopsis

Command injection in InHand Networks IR912 and IR915 firmware (version V1.0.0.r20042 and earlier) allows a remote attacker with no authentication to execute arbitrary operating system commands as root via a crafted file upload. The vulnerability is reachable over the network and requires no user interaction, making it trivially weaponizable. Successful exploitation gives the attacker full root-level control of the device, enabling data theft, persistent backdoor installation, or complete service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable file upload function is exposed over the network, so an attacker must be able to reach the device's interface across the internet or an internal network segment.

• AuthenticationNot required

  No credentials are needed; the command injection is reachable by any unauthenticated caller.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user of the device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to send a crafted file upload request with no dependency on race conditions or memory layout.

Blast Radius

• A successful attacker executes arbitrary OS commands as root, gaining complete administrative control of the IR912 or IR915 device.
• Confidential data stored on or transmitted through the device (credentials, VPN keys, routing tables, session tokens) is readable in full.
• The attacker can modify device configuration, firmware, or routing rules, redirecting or intercepting network traffic passing through the device.
• The device can be crashed or rendered permanently unavailable, disrupting any network services or connected OT/industrial systems that depend on it.