← Back to CVE feed
CVE-2026-38703
Description
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Products
inhandnetworks/ir302
inhandnetworks/ir302_firmware
inhandnetworks/ir305
inhandnetworks/ir305_firmware
inhandnetworks/ir315
inhandnetworks/ir315_firmware
inhandnetworks/ir615
inhandnetworks/ir615_firmware