Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 8 products
🔴 InHand Networks IR302/IR305/IR315/IR615, Command Injection, #CVE-2026-38703 (Critical) -DC-May2026-48 https://dailycve.com/inhand-networks-ir302-ir305-ir315-ir615-command-injection-cve-2026-38703-critical-dc-may2026-48/
Post summary
The post announces a critical command injection vulnerability (CVE-2026-38703) in InHand Networks devices, providing a link to a CVE report but lacking details on exploitation or mitigation.
🚨 CRITICAL: CVE-2026-38703 (CVSS 9.8) - Command injection in InHand Networks IR302/IR305/IR315/IR615 routers allows remote ROOT access via ZeroTier VPN. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/MgDtZBs4WK
Post summary
The tweet announces the discovery of CVE-2026-38703 with a high CVSS score and urges immediate patching to prevent remote root attacks via ZeroTier VPN.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | inhandnetworks | ir302 | - | - | - |
| OS | inhandnetworks | ir302_firmware | - | - | - |
| HW | inhandnetworks | ir305 | - | - | - |
| OS | inhandnetworks | ir305_firmware | - | - | - |
| HW | inhandnetworks | ir315 | - | - | - |
| OS | inhandnetworks | ir315_firmware | - | - | - |
| HW | inhandnetworks | ir615 | - | - | - |
| OS | inhandnetworks | ir615_firmware | - | - | - |