PT-2026-44406 · Inhand Networks · Ir302+3

Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-38707

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InHand Networks IR302 versions prior to V3.5.108 InHand Networks IR305 versions prior to V1.0.118 InHand Networks IR315 versions prior to V1.0.118 InHand Networks IR615 versions prior to V1.0.118

Description A command injection issue exists in the IPSec VPN feature. This allows remote attackers to execute arbitrary commands and obtain ROOT privileges on the target devices.

Recommendations Update IR302 to version V3.5.108 or later. Update IR305 to version V1.0.118 or later. Update IR315 to version V1.0.118 or later. Update IR615 to version V1.0.118 or later. As a temporary workaround, consider disabling the IPSec VPN feature to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-38707

Affected Products

Ir302

Ir305

Ir315

Ir615

References · 3

• https://inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-38707 · Security Note
• https://twitter.com/DFIR_Lab/status/2060168553865617688 · Twitter Post