A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks firmware for IR302, IR305, IR315, and IR615 devices. Attackers can exploit this vulnerability to obtain root privileges on remote target devices. This flaw directly compromises confidentiality, integrity, and availability by allowing an attacker to fully control the device.

InHand Networks firmware versions V3.5.108 for IR302, V1.0.118 for IR305, IR315, and IR615, as well as any earlier build of these devices. Users operating these models should verify the firmware version in use and consider updating to a version that includes the fix.

The vulnerability allows remote command execution through the ZeroTier VPN interface, enabling an attacker to acquire root privileges on the device. The exact attack vector is likely a crafted VPN packet sent over the network, though the specific packet format is not disclosed. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the CVSS score of 9.8 signals a severe risk. The ability to execute commands with root privileges could allow an attacker to fully compromise the device.