VulnSocial

CVE-2026-38702Patch(inhandnetworks / ir302)

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch inhandnetworks ir302 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

inhandnetworks CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-77

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ir302
  • ir302_firmware
  • ir305
  • ir305_firmware

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
inhandnetworks
Products
ir302ir302_firmwareir305ir305_firmwareir315ir315_firmwareir615ir615_firmware

1 version affected across 8 products

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-05-29: 3Patch / Workaround · 2026-05-29: 2Technical Details · 2026-05-29: 305-29
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Full discourse3 posts
  • CCB Alert@CCBalert
    Patch

    Warning: A critical command injection #vulnerability in #InHand Networks IR302/IR305/IR315/IR615 #industrial routers allows attackers to gain root privileges. #CVE-2026-38702 CVSS(3.1): 9.8. Read the advisory at https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf and #Patch #Patch #Patch

    Post summary

    A critical command injection vulnerability (CVE‑2026‑38702) affecting InHand industrial routers (CVSS 9.8) is disclosed, enabling root privilege escalation; a patch is available as per the vendor advisory.

    02000255
    7.2K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 InHand Networks IR Series, Command Injection, #CVE-2026-38702 (Critical) -DC-May2026-47 https://dailycve.com/inhand-networks-ir-series-command-injection-cve-2026-38702-critical-dc-may2026-47/

    Post summary

    The post announces the discovery of a critical command injection vulnerability (CVE‑2026‑38702) affecting InHand Networks IR Series, without mentioning patches or exploit details.

    0000042
    207 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-38702 (CVSS 9.8) Command injection in InHand Networks IR302/305/315/615 routers allows unauthenticated remote attackers to gain ROOT access. Affected: firmware V3.5.108/V1.0.118 & earlier Patch immediately! #CVE #PatchNow #ThreatIntel https://t.co/onpTRGQ65U

    Post summary

    The tweet highlights a critical command injection flaw in InHand Networks routers, urging immediate patching.

    0000051
    31 followersView on X
CPE platform detail8 entries

8 of 8 entries

PartVendorProductVersionTarget SWTarget HW
HWinhandnetworksir302---
OSinhandnetworksir302_firmware---
HWinhandnetworksir305---
OSinhandnetworksir305_firmware---
HWinhandnetworksir315---
OSinhandnetworksir315_firmware---
HWinhandnetworksir615---
OSinhandnetworksir615_firmware---

Explore more

Back to dashboardinhandnetworks CVEsir302 vulnerabilities