CVE-2026-38704

published 2026-05-28

CVE-2026-38704: A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware…

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
inhandnetworks	ir302_firmware	< 3.5.112	3.5.112
inhandnetworks	ir305_firmware	< 1.0.121	1.0.121
inhandnetworks	ir315_firmware	< 1.0.121	1.0.121
inhandnetworks	ir615_firmware	< 1.0.121	1.0.121

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77