CVE-2026-38715: InHand IR912/IR915 Command Injection
Critical CVSS (9.8) reachable over network.
TL;DR - CVE-2026-38715 is a CVSS 9.8 Critical command-injection vulnerability affecting InHand IR912 and IR915 devices. - Firmware V1.0.0.r20042 and earlier is affected, and successful commands may execute with root privileges. - No verified public proof of concept or confirmed active exploitation is known, but exposed management interfaces should be isolated and affected devices remediated urgently.
Summary
CVE-2026-38715 affects InHand Networks IR912 and IR915 industrial networking devices. The vulnerability reportedly exists in the log-viewing function and may allow a remote attacker to execute arbitrary operating-system commands with root privileges by submitting crafted input.
Because these devices may provide connectivity to industrial, operational-technology, enterprise, or remote-site networks, compromise could extend beyond the appliance itself. An attacker may be able to alter routing, firewall, VPN, or DNS settings; disable logging; establish persistence; or use the device as a foothold into connected networks.
The NVD record assigns the vulnerability a CVSS 3.1 score of 9.8, rated Critical. The available record does not provide the complete CVSS vector or establish whether authentication is required, whether the vulnerable function is enabled by default, or whether the interface is exposed by default. Administrators should verify management-plane exposure directly rather than relying on assumptions.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-38715 |
| CVSS | 9.8 Critical |
| Affected products | InHand Networks IR912 and IR915 |
| Affected versions | V1.0.0.r20042 and earlier |
| Vulnerable component | Log-viewing function |
| Reported impact | Remote command execution as root |
| Patch available | Fixed version not established from the available NVD data |
| CISA KEV | Not listed at the time of lookup |
| Public PoC | No verified public PoC identified |
| Confirmed exploitation | No confirmed in-the-wild exploitation identified |
The absence of a CISA Known Exploited Vulnerabilities listing does not prove that exploitation is impossible or absent. It means only that CISA had not added this CVE when the referenced lookup was performed.
Analyst’s Take: Reduce exposure first rather than waiting for a public PoC or KEV listing. The corrected firmware number is not established in the available NVD data, so confirm the vendor’s fixed version while restricting access to affected management interfaces.
Root Cause and Impact
The reported root cause is command injection in the device’s log-viewing functionality. A crafted value may reach command-processing logic without being safely handled, allowing attacker-controlled content to be interpreted as an operating-system command.
The available vulnerability description does not identify the exact request parameter, web endpoint, input field, shell invocation, or escaping failure. Defenders should therefore avoid building narrow detection rules around an assumed payload or parameter.
The reported root-level execution context increases the potential impact. Successful exploitation could allow an attacker to:
- Modify routing, firewall, VPN, or DNS configuration.
- Disable or tamper with logging.
- Create accounts or persistence mechanisms.
- Install additional tooling.
- Redirect or intercept traffic.
- Disrupt communications or remote-site connectivity.
- Use the device to reach connected enterprise or operational-technology networks.
Organizations managing broader industrial network security risk should treat the device’s network position as an important part of remediation priority.
No reliable technical evidence in the supplied sources confirms whether exploitation requires prior authentication, a particular role, a non-default configuration, or access to a dedicated management network. Obtain those details from the InHand advisory and product documentation before using them to lower priority.
Who Is Exposed?
The affected products are the InHand Networks IR912 and IR915. The NVD description identifies firmware V1.0.0.r20042 and earlier as affected:
- IR912 V1.0.0.r20042 and earlier
- IR915 V1.0.0.r20042 and earlier
The supplied research does not establish a corrected firmware number. It also does not confirm whether every regional, hardware, or carrier-specific build using the same version label is affected.
For each device, record:
- Product and hardware revision.
- Complete firmware version.
- Management IP addresses and interfaces.
- Permitted source networks.
- Deployment role and connected trust zones.
- Administrative access path.
- Recent configuration and authentication activity.
Prioritize devices that are:
- Reachable from the public internet.
- Accessible from user, guest, partner, or third-party networks.
- Positioned between corporate and industrial or operational-technology segments.
- Managed with shared credentials.
- Missing centralized access controls or monitoring.
- Showing unexplained administrative access or configuration changes.
A device isolated on a dedicated management network has a smaller remote attack surface, but isolation does not eliminate risk. A compromised administrator workstation, VPN account, adjacent router, or trusted management host may still provide access to the vulnerable function.
Severity Breakdown
The NVD assigns CVE-2026-38715 a CVSS 3.1 score of 9.8, placing it in the Critical category. The score is consistent with the reported combination of remote command injection, potentially broad network reachability, and root-level impact.
Successful exploitation could affect:
- Confidentiality: Device configuration, credentials, traffic metadata, or connected-network information could be exposed.
- Integrity: Routes, firewall rules, VPN settings, system files, or administrative accounts could be changed.
- Availability: Services could be disabled, communications disrupted, configurations deleted, or devices rendered inaccessible.
Several scoring details remain unknown:
- Whether authentication is required.
- Whether the vulnerable function is enabled by default.
- Whether a specific administrative role is needed.
- Whether the interface is normally reachable from untrusted networks.
- Whether user interaction or a particular device state is required.
Do not lower operational priority solely because these fields remain unresolved. Identify actual exposure by reviewing listening management services, permitted source networks, VPN paths, and firewall rules.
Exploitation Status
No confirmed in-the-wild exploitation was identified in the retrieved sources. CVE-2026-38715 was also not listed in CISA’s Known Exploited Vulnerabilities catalog during the referenced lookup.
No verified public proof-of-concept repository was identified in the supplied research. However, the absence of a public PoC does not mean exploitation is impractical. Command-injection vulnerabilities in exposed management functions may attract attackers before technical details become public.
Treat the current status as unknown but unconfirmed, not safe. Continue monitoring:
- InHand security advisories.
- NVD record updates.
- CISA KEV additions.
- Threat-intelligence reporting.
- Internal device and network telemetry.
If an affected device was exposed to the internet or an untrusted network, investigate before assuming that the lack of public reporting means no compromise occurred.
Related Security Resources
For broader context, review the C2 glossary when investigating suspicious outbound communications from network appliances. If your organization is also assessing cloud-connected assets, the cloud security posture management glossary provides useful background on identifying configuration and exposure risks across cloud environments.
Sources
-
NVD: CVE-2026-38715
Provides the CVE description, affected products and versions, CVSS score, publication metadata, and vendor reference. -
InHand Networks Product Security Advisory, June 2026
The primary vendor source for fixed firmware, upgrade instructions, workarounds, and product-specific exposure details. Confirm the corrected version here before remediation. -
CISA Known Exploited Vulnerabilities Catalog
The referenced lookup did not list CVE-2026-38715. KEV absence should not be interpreted as proof that exploitation is not occurring.
As of the research described for this article, CVE-2026-38715 has a reported CVSS score of 9.8, affects IR912 and IR915 firmware V1.0.0.r20042 and earlier, and may permit root-level remote command execution through the log-viewing function. No verified public PoC or confirmed active exploitation was identified. Administrators should consult the vendor advisory directly and treat unpatched, remotely reachable devices as high priority.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine asset inventory, management-plane telemetry, authentication records, configuration auditing, and network monitoring.
The vulnerability affects a log-viewing function, but the precise endpoint and input parameter are not available from the supplied sources. Avoid relying on a payload-only signature that could create false confidence or miss alternate encodings.
Start by identifying every IR912 and IR915 device, its firmware version, management addresses, permitted source networks, and administrative access path. Review device and upstream firewall logs for requests to management interfaces, especially from unexpected addresses or at unusual times.
Correlate suspicious activity with:
- Configuration changes.
- Reboots and service restarts.
- Route-table or firewall changes.
- VPN or DNS modifications.
- New outbound connections.
- Credential or account changes.
- Unexpected file or process activity.
- Changes in connected peers.
Technical Notes
A generic management-log review can begin with:
# Adjust the path and fields for the device, reverse proxy, or SIEM export.
grep -Ei 'IR912|IR915|log|view|cmd|command|shell|sh -c|;/|&&|\\$\\(' \\
/var/log/management-access.log
Potentially suspicious patterns include repeated requests to a log-viewing endpoint containing shell metacharacters, encoded separators, command-substitution syntax, or unexpected arguments. These patterns are not a confirmed exploit signature because the vulnerable parameter and endpoint were not published in the supplied record.
A SIEM query could focus on the following sequence:
(device_product IN ("InHand IR912", "InHand IR915"))
AND (
request_uri CONTAINS "log"
OR request_uri CONTAINS "view"
)
AND (
request_uri MATCHES "(%3B|%26%26|%7C|%24%28|%60|;|&&|\\||\\$\\()"
OR user_agent NOT IN approved_management_agents
OR source_ip NOT IN approved_management_subnets
)
Use this as a starting point, not proof of exploitation. Validate field names, URL decoding, and normal administrative behavior in the local environment.
If compromise is suspected, preserve device logs and upstream firewall records before rebooting or resetting the appliance. Capture the current configuration, firmware metadata, routing state, connected peers, and relevant authentication records. Root-level compromise may invalidate local logs, making network-side evidence particularly important.
Remediation Steps
1. Inventory affected devices
Identify every IR912 and IR915 device and verify its complete firmware version. Treat devices running V1.0.0.r20042 or earlier as affected.
The available NVD data does not specify a fixed version. Do not infer that a later-looking build is safe without confirming it in the InHand Networks security advisory.
2. Confirm the vendor’s fixed firmware
The vendor advisory linked by the NVD record is the authoritative source for the corrected firmware, upgrade procedure, workarounds, and product-specific details:
Upgrade each affected device to the exact fixed firmware identified by the advisory. Because the fixed version was not established in the available research material, it would be unsafe to state a replacement version here.
Before upgrading:
- Record the current firmware and hardware revision.
- Back up the configuration.
- Confirm image authenticity and compatibility.
- Schedule an approved maintenance window.
- Verify a recovery or replacement path.
- Document the device’s network role and dependencies.
After upgrading, verify the firmware version, management access, routing, VPN connectivity, logging, and connected services.
3. Restrict management access immediately
If patching cannot happen immediately:
- Remove management access from the public internet.
- Permit access only from a dedicated administrative subnet or trusted VPN.
- Block management and log-viewing services at upstream firewalls.
- Restrict administrative accounts and remove unnecessary access.
- Monitor for unexpected configuration changes and outbound connections.
- Consider taking an exposed device out of service if it bridges sensitive networks.
Network isolation is a compensating control, not a patch. It reduces attack paths but does not remove the command-injection flaw or address compromise that occurred before isolation.
4. Investigate suspected compromise
If evidence of compromise exists:
- Isolate the device while preserving evidence.
- Capture device, firewall, VPN, authentication, and network telemetry.
- Rotate credentials and cryptographic material that may have been accessible.
- Review neighboring infrastructure for unauthorized changes.
- Rebuild or replace the device according to incident-response procedures.
- Validate routes, firewall rules, VPN peers, DNS settings, and administrative accounts.
- Continue monitoring after remediation.
Do not assume that a firmware upgrade alone removes persistence or restores trust in a previously compromised appliance.