CVE-2026-38702: A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware…

PriorityP265critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.24%

65.5th percentile

A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
inhandnetworks	ir302_firmware	< 3.5.112	3.5.112
inhandnetworks	ir305_firmware	< 1.0.121	1.0.121
inhandnetworks	ir315_firmware	< 1.0.121	1.0.121
inhandnetworks	ir615_firmware	< 1.0.121	1.0.121

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.