External risk intelligence

InHand Networks Firmware Command Injection Allows ROOT Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-38702

The affected products are industrial cellular routers and gateways typically deployed at the network edge to provide internet connectivity. As network edge devices, their management interfaces, particularly those intended for remote administration, are frequently exposed to the public internet or reachable from external networks by design.

Command Injection

Inhandnetworks Ir315 Firmware

before 1.0.121before 3.5.112

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability in InHand Networks industrial routers could allow unauthorized users to gain full administrative control of devices. This issue affects the Admin Access feature, potentially exposing connected systems to compromise. The main concern is confirming relevance and exposure.

Unauthorized control of network devices.
Confirms need to verify usage and potential exposure.
Assess router usage and administrative access.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a command injection vulnerability in the Admin Access feature of InHand Networks routers. This vulnerability requires no authentication and can be triggered remotely, potentially allowing an attacker to gain full administrative control, including ROOT privileges, on the targeted device.

Unauthenticated remote access required.
Triggers vulnerability in Admin Access feature.
Risk of complete device takeover.

Live Threat

Current exploitation, exposure, and threat context

The Admin Access feature in InHand Networks industrial routers could allow an attacker to gain full control (ROOT privileges) of the device when accessed over the network. This could impact the device's operational integrity and the network services it manages.

Device root access at risk.
Unauthenticated network access.
Full device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The command injection vulnerability in InHand Networks industrial routers and gateways likely falls under the responsibility of infrastructure or platform teams managing these edge devices. The immediate first step is to identify all instances of the affected firmware, confirm their exposure and criticality, and then determine the accountable owner for remediation planning.

Infrastructure/platform teams own the issue.
Verify affected device exposure and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the InHand Networks equipment affected by this vulnerability?

These devices are industrial cellular routers and gateways, such as the IR302, IR305, IR315, and IR615 series. They are designed to sit at the network edge, acting as critical bridge points that provide internet connectivity to industrial or remote systems, managing traffic flow between local networks and the broader internet.

How does CVE-2026-38702 allow unauthorized control?

This issue is a command injection vulnerability, classified as CWE-77. It occurs when a program improperly processes input, allowing an attacker to insert and execute their own operating system commands. In the context of this CVE, it means the router's Admin Access feature fails to sanitize data, letting an unauthenticated person run malicious commands with ROOT privileges.

Do I need to be logged into the router to trigger this bug?

No, this vulnerability does not require authentication. An attacker can trigger the command injection remotely by sending specially crafted requests to the device's Admin Access feature. The vulnerability is specifically linked to how these administrative functions handle incoming network traffic, meaning it is not triggered by standard, non-administrative network operations.

Why should I care about this if my router is internal?

Halo Surface Signal indicates that because these are edge devices intended for connectivity, their management interfaces are frequently exposed to the public internet by design. If your device is reachable from an external network, it faces a higher risk. You should assess whether the management interface is accessible outside of a secure, restricted administrative network.

What is the first step to address this CVE?

The priority is to locate all routers in your environment running the affected firmware versions. Once identified, verify if the management interface is exposed to the internet. Coordinate with the teams responsible for your infrastructure to plan for applying the necessary firmware updates provided by InHand Networks to remove the vulnerability.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.