A command injection flaw exists in the log‑viewing feature of InHand Networks IR912 and IR915 devices. The vulnerability allows an attacker to supply crafted input that is passed unfiltered to the operating‑system command interpreter, enabling the execution of arbitrary commands with root privileges. The primary consequence is the compromise of the entire device, potentially allowing full control, lateral movement, or persistence on the network.

Devices running InHand Networks IR912 and IR915 firmware versions V1.0.0.r20042 and earlier are affected. The flaw resides specifically in the log viewing functionality of these models.

The CVSS score is not provided in the available data, but the nature of the flaw—operating‑system command injection executing as root—suggests a high severity. The EPSS score is undisclosed, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access to the log viewing interface, presumably over the device’s management network; this inference is drawn from the description which states that authenticated or unauthenticated remote attackers can trigger the exploit. The exploitation requires only the ability to submit crafted input to the vulnerable function, indicating a low barrier for an attacker who can reach the device externally.