A command injection flaw exists in the ZeroTier VPN feature of InHand Networks firmware for IR302, IR305, IR315, and IR615 devices. By sending crafted packets, an attacker can cause the VPN daemon to execute arbitrary commands, which grants full root privileges on the affected device. This flaw directly compromises confidentiality, integrity, and availability by enabling an attacker to fully control the device.

InHand Networks firmware versions V3.5.108 for IR302, V1.0.118 for IR305, IR315, and IR615, as well as any earlier build of these devices. Users operating these models should verify the firmware version in use and consider updating to a version that includes the fix.

The exploit requires remote access to the ZeroTier VPN interface; the exact attack vector is likely a crafted VPN packet sent over the network. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the potential impact of gaining root means the risk remains high. Attackers could abuse this flaw to install malware, exfiltrate data, or pivot to other network assets.