CVE-2026-38716
published 2026-06-18CVE-2026-38716: InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.32%
67.2th percentile
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inhandnetworks | ir912l-fq58_firmware | < 1.0.0.r20044 | 1.0.0.r20044 |
| inhandnetworks | ir915l-fq39-s_firmware | < 1.0.0.r20044 | 1.0.0.r20044 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
InHand IR912/IR915 1.0.0.r20042 command injection (EUVD-2026-37919)
vuldb·2026-06-18
CVE-2026-38716 [CRITICAL] InHand IR912/IR915 1.0.0.r20042 command injection (EUVD-2026-37919)
A vulnerability was found in InHand IR912 and IR915 1.0.0.r20042. It has been rated as critical. The impacted element is an unknown function. Performing a manipulation results in command injection.
This vulnerability is known as CVE-2026-38716. Remote exploitation of the attack is possible. No exploit is available.
GHSA
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function.
ghsa_unreviewed·2026-06-18
CVE-2026-38716 [CRITICAL] CWE-77 InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function.
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-18
Published