CVE-2026-38702

The vulnerability (CWE-77) consists of improper neutralization of special characters or control sequences in input data passed to the command interpreter in the Admin Access function. An attacker can craft an appropriate network request containing a malicious payload that is executed directly by the device's operating system. Due to the network vector (AV:N), lack of requirements for attack complexity (AC:L), and lack of need for privileges (PR:N), the vulnerability is particularly dangerous in environments exposed to the internet.

Successful exploitation of the vulnerability gives the attacker full ROOT privileges on the remote device, which means complete control over the device, ability to read and modify configuration, and potential use of the device as an entry point to the internal network.

Apply patches available from the manufacturer according to the references (https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf). Until firmware is updated, it is recommended to restrict access to the administrative interface only to trusted IP addresses and isolate devices from the public network using a firewall.

InHand Networks IR302 firmware V3.5.108 and earlier, IR305 firmware V1.0.118 and earlier, IR315 firmware V1.0.118 and earlier, IR615 firmware V1.0.118 and earlier