CVE-2026-38704

WireGuard VPN Command Injection in InHand Networks Routers Allowing Remote Root Access

Published May 28, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Description

A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

Analysis

Technical impact

A command injection vulnerability is present in the WireGuard VPN component of certain InHand Networks router firmware. The flaw allows a remote attacker to inject arbitrary shell commands, which are executed with root privileges on the affected device. The weakness is a classic input validation error (CWE-77).

Affected Systems

InHand Networks routers IR302 (firmware V3.5.108), IR305, IR315, and IR615 (firmware V1.0.118), and all earlier firmware releases of these models are susceptible to the vulnerability.

Risk and Exploitability

The attack vector is remote, leveraging the WireGuard VPN interface exposed by the firmware. The CVSS score of 9.8 denotes critical severity, while the EPSS score of 1% indicates a very low but non-zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The ability to gain root over the VPN poses a severe threat to device integrity and network security.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:inhandnetworks:ir315_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir315:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:inhandnetworks:ir302_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir302:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:inhandnetworks:ir615_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir615:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:inhandnetworks:ir305_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:inhandnetworks:ir305:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Inhandnetworks

Wireguard Vpn

Version	Status	Scheme	Platform
`[0,3.5.108]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the device firmware to the latest version released by InHand Networks that addresses the command injection flaw
If an update is not immediately available, disable the WireGuard VPN function or restrict its access so that only trusted networks can reach it
Use firewall rules or network segmentation to limit exposure of the WireGuard interface to untrusted hosts
Surveil system logs for unexpected executions of shell commands that could indicate exploitation attempts

Generated by OpenCVE AI on June 18, 2026 at 12:57 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.3% (1.269% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf

History

Jun 18, 2026 4:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		WireGuard VPN Command Injection in InHand Networks Routers Allowing Remote Root Access

Jun 17, 2026 12:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Command Injection via WireGuard VPN in InHand Networks Router Firmware

Jun 16, 2026 12:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Command Injection via WireGuard VPN in InHand Networks Router Firmware

May 30, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Inhandnetworks wireguard Vpn
Vendors & Products		Inhandnetworks wireguard Vpn

May 29, 2026 2:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Inhandnetworks Inhandnetworks ir302 Inhandnetworks ir302 Firmware Inhandnetworks ir305 Inhandnetworks ir305 Firmware Inhandnetworks ir315 Inhandnetworks ir315 Firmware Inhandnetworks ir615 Inhandnetworks ir615 Firmware
CPEs		cpe:2.3:h:inhandnetworks:ir302:-:::::::* cpe:2.3:h:inhandnetworks:ir305:-:::::::* cpe:2.3:h:inhandnetworks:ir315:-:::::::* cpe:2.3:h:inhandnetworks:ir615:-:::::::* cpe:2.3:o:inhandnetworks:ir302_firmware:::::::: cpe:2.3:o:inhandnetworks:ir305_firmware:::::::: cpe:2.3:o:inhandnetworks:ir315_firmware:::::::: cpe:2.3:o:inhandnetworks:ir615_firmware::::::::
Vendors & Products		Inhandnetworks Inhandnetworks ir302 Inhandnetworks ir302 Firmware Inhandnetworks ir305 Inhandnetworks ir305 Firmware Inhandnetworks ir315 Inhandnetworks ir315 Firmware Inhandnetworks ir615 Inhandnetworks ir615 Firmware

May 28, 2026 7:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Command Injection in InHand Networks IR302-IR615 VPN Firmware Allows Remote Root Access
Weaknesses	CWE-269 CWE-78

May 28, 2026 6:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Command Injection in InHand Networks IR302-IR615 VPN Firmware Allows Remote Root Access
Weaknesses		CWE-269 CWE-78

May 28, 2026 6:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-77
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 28, 2026 5:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
References		https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf