CVE-2026-38704
Critical
Description
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
SeverityCritical
CVSS9.8
Exploit probability—
ProductInhandnetworks Ir315 Firmware
PublishedMay 28, 2026
First seenMay 28, 2026
Weakness typeCWE-77Command injection
How to fix
Update
- inhandnetworks ir315_firmware1.0.121 or later
- inhandnetworks ir302_firmware3.5.112 or later
- inhandnetworks ir615_firmware1.0.121 or later
- inhandnetworks ir305_firmware1.0.121 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inhandnetworks ir315_firmware | v < 1.0.121 | 1.0.121 |
| inhandnetworks ir302_firmware | v < 3.5.112 | 3.5.112 |
| inhandnetworks ir615_firmware | v < 1.0.121 | 1.0.121 |
| inhandnetworks ir305_firmware | v < 1.0.121 | 1.0.121 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.