External risk intelligence

InHand Networks IR/R3 Series Firmware Command Injection Allows Root Access.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-38703

The vulnerability affects industrial routers and gateways, which are specifically designed to be deployed at the network edge to facilitate connectivity. As VPN-capable network infrastructure, these devices are commonly exposed to the internet to provide remote access and inter-site communication, making the vulnerable service directly reachable from the public internet in normal deployment patterns.

Command Injection

Inhandnetworks Ir315 Firmware

before 1.0.121before 3.5.112

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified within the ZeroTier VPN feature of certain InHand Networks industrial routers. This flaw could allow an unauthorized party to gain complete control of affected devices remotely. The main concern is confirming whether these devices are deployed within our environment and are exposed to this specific risk.

Unchecked commands allow remote device takeover.
Affects critical edge networking devices.
Assess exposure and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a command injection vulnerability in the ZeroTier VPN feature of certain InHand Networks devices. This exposure allows an attacker to remotely send specially crafted commands to the device, ultimately leading to full administrative control with ROOT privileges.

Accessible over the network.
Triggered via the VPN feature.
Leads to root access.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the ZeroTier VPN feature of InHand Networks devices could allow unauthenticated attackers to gain root privileges on remote devices. This could lead to full system compromise when the vulnerable service is exposed externally.

Root access to network devices.
Remote attackers can inject commands.
Full control over affected devices.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and infrastructure owners are responsible for addressing this critical command injection vulnerability in InHand Networks devices. The first step is to inventory all InHand Networks routers and gateways, confirm their exposure to the network, and identify the accountable owner for each device. Subsequently, a risk-based remediation plan should be developed, coordinating with relevant teams and potentially the vendor.

Infrastructure and security teams own remediation.
Verify device exposure and network criticality.
Plan risk-based remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the InHand Networks IR series equipment?

These are industrial-grade routers and gateways used to manage network connectivity in remote or challenging environments. They often act as critical edge infrastructure, supporting features like ZeroTier VPN to enable secure, site-to-site communication and remote device management across distributed industrial networks.

What does CWE-77 mean for CVE-2026-38703?

CWE-77 is a weakness class called Command Injection. It occurs when a system fails to properly filter or sanitize the input it receives before passing it to a command-line interface. In the case of this CVE, the vulnerability allows an attacker to insert and execute their own unauthorized commands, effectively tricking the router into running malicious instructions with full ROOT-level privileges.

How is this command injection vulnerability triggered?

The flaw is triggered specifically through the ZeroTier VPN feature found in the router firmware. An attacker sends specially crafted data to this component to initiate the unauthorized command execution. It is important to note that typical, non-malicious use of the VPN connection itself does not trigger this bug; the vulnerability resides in how the system processes input commands within that feature.

How does Halo Surface Signal assess this risk?

Halo Surface Signal notes that because these routers function as network edge infrastructure, they are frequently connected directly to the internet to facilitate remote access. This placement makes the vulnerable ZeroTier VPN service highly reachable, increasing the likelihood that an attacker could attempt to exploit the device remotely.

What should I do if I manage these devices?

Begin by inventorying your environment to identify all InHand Networks routers and gateways currently in use. Once you have a complete list, verify the firmware version of each device to see if it matches the affected models. Finally, coordinate with the vendor to obtain and apply the necessary firmware updates to mitigate the risk and protect the system from unauthorized access.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.