Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-38703 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-38703

CVE-2026-38703

CRITICAL9.8

A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3

Published May 28, 2026

Modified 1 weeks ago

Details

A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.

References

https://www.cve.org/CVERecord?id=CVE-2026-38703

https://www.inhand.com/wp-content/uploads/InHand-PSA-2026-05_EN.pdf

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedMay 28, 2026

ModifiedMay 28, 2026