The vulnerability is a command injection flaw in InHand Networks IR912 and IR915 firmware that allows an attacker to run arbitrary commands on the device as root. The flaw is triggered by crafted input to the Python configuration function, meaning that no local privileges are required; anyone who can reach the vulnerable interface can immediately gain full system control, with no user interaction needed.

The affected devices are InHand Networks IR912 and IR915 running firmware versions V1.0.0.r20042 and all earlier releases. The exact product names are InHand IR912 and IR915 network controllers.

Because the flaw permits remote execution of code with root privileges, the potential impact is total compromise of confidentiality, integrity, and availability of the device. The vulnerability is highly severe, and although EPSS data is unavailable and it is not listed in the CISA KEV catalog, the absence of mitigation means any remote attacker could exploit it at will. The likely attack vector is remote access to the device’s configuration interface, which is commonly exposed to the management network. The CVSS score of 9.8 confirms a critical rating.