External risk intelligence

InHand IPSec VPN Command Injection Allows Root Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-38707

The vulnerability exists in the IPSec VPN feature of industrial routers. VPN gateways and remote access appliances are designed to be internet-facing to facilitate secure connections, making them a common and intentional part of the public-facing network perimeter in normal deployments.

Command Injection

Inhandnetworks Ir315 Firmware

before 1.0.121before 3.5.112

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection flaw in the IPSec VPN feature of certain InHand Networks routers allows unauthorized users to gain full administrative control of affected devices. This vulnerability could enable attackers to compromise the integrity and availability of critical infrastructure or operational technology systems. The main concern is confirming relevance and exposure.

Command injection in VPN feature.
Grants full administrative control.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with network access could target the IPSec VPN feature of InHand Networks routers. By sending specially crafted commands, they could exploit a vulnerability to gain full administrative control, potentially leading to severe system compromise.

Network access required.
Command injection in IPSec VPN.
Attains ROOT privileges remotely.

Live Threat

Current exploitation, exposure, and threat context

The IPSec VPN feature in InHand Networks routers could allow remote attackers to gain full administrative control. This could affect the confidentiality, integrity, and availability of the device and its network functions.

Device control and network access.
Unauthenticated remote command injection.
Compromised device and network integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and network teams likely own this vulnerability, as it affects the IPSec VPN feature of industrial routers. The first step is to identify all instances of the affected InHand Networks devices, confirm their exposure to the internet, and determine which are business-critical. Once accountable owners are identified, a risk-based remediation plan can be developed, potentially involving vendor coordination.

Identify affected devices and assess exposure.
Confirm device reachability and business criticality.
Plan remediation with the accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the InHand Networks IR302 and related router series?

These are industrial-grade cellular routers used to provide reliable network connectivity for critical infrastructure and operational technology. They are frequently deployed to connect remote field equipment to a central network via secure IPSec VPN tunnels.

How does CVE-2026-38707 allow command injection?

This vulnerability is categorized as CWE-77, which occurs when an application improperly neutralizes special characters in a command string. In this case, the VPN feature fails to sanitize input, allowing an attacker to inject and execute unauthorized commands directly on the device's operating system with full ROOT privileges.

When does this command injection vulnerability trigger?

The flaw is triggered when the device receives specially crafted network traffic specifically directed at its IPSec VPN service. Normal, legitimate administrative actions or standard network traffic that does not contain malicious command sequences will not trigger the vulnerability.

Why should I be concerned if my device is internet-facing?

Halo Surface Signal indicates these routers often serve as internet-facing VPN gateways by design. If a device is reachable from the public internet, it lacks the protective barrier of an internal network, significantly increasing the probability that an attacker can reach and exploit the vulnerable VPN service.

What is the first step to address this for my InHand equipment?

Start by creating an inventory of all deployed IR302, IR305, IR315, and IR615 units to verify their current firmware version. Once identified, evaluate whether these devices are exposed to the public internet, as these instances require the most immediate attention to prevent unauthorized remote access.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.