PT-2026-44403 · Inhand Networks · Ir305+3

Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-38702

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR302 versions prior to V3.5.108 InHand Networks IR305 versions prior to V1.0.118 InHand Networks IR315 versions prior to V1.0.118 InHand Networks IR615 versions prior to V1.0.118

Description A command injection issue exists in the Admin Access feature. This allows unauthenticated remote attackers to execute arbitrary commands and obtain ROOT privileges on target devices.

Recommendations Update IR302 to a version later than V3.5.108. Update IR305 to a version later than V1.0.118. Update IR315 to a version later than V1.0.118. Update IR615 to a version later than V1.0.118.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-38702

Affected Products

Ir302

Ir305

Ir315

Ir615

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-38702 · Security Note
• https://inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf · Vendor Advisory
• https://twitter.com/CCBalert/status/2060363177552961770 · Twitter Post
• https://twitter.com/dailycve/status/2060387075740823601 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2060153452710223969 · Twitter Post