Inhandnetworks vulnerabilities

We track 41 vulnerabilities in Inhandnetworks products across 9 products. 41 are rated high or critical, and none are known to be exploited. The most recent was published on June 18, 2026.

41vulnerabilities

20critical

21high

0exploited

9.0average CVSS score

Latest Inhandnetworks vulnerabilities

7.5 High severity
Ir915l-fq39-s Firmware: Buffer Copy without Checking Size of Input
CVE-2026-38718Jun 18, 2026Inhandnetworks
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulnerability in the device registration function. This vulnerability could allow an attacker to cause a denial of service att
9.8 Critical severity
Ir915l-fq39-s Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38717Jun 18, 2026InhandnetworksEPSS 2.31%
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function. The vulnerability allows remote attackers to execute arbitrary commands as root v
9.8 Critical severity
Ir915l-fq39-s Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38716Jun 18, 2026InhandnetworksEPSS 2.31%
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary com
9.8 Critical severity
Ir915l-fq39-s Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38715Jun 18, 2026InhandnetworksEPSS 2.31%
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function. This vulnerability allows remote attackers to execute arbitrary commands as root
9.8 Critical severity
Ir915l-fq39-s Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38714Jun 18, 2026InhandnetworksEPSS 2.31%
InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function. This vulnerability allows remote attackers to execute arbitrary commands
9.8 Critical severity
Ir315 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38707May 28, 2026InhandnetworksEPSS 1.24%
A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain RO
9.8 Critical severity
Ir315 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38704May 28, 2026InhandnetworksEPSS 1.27%
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtai
9.8 Critical severity
Ir315 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38703May 28, 2026InhandnetworksEPSS 1.24%
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain
9.8 Critical severity
Ir315 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2026-38702May 28, 2026InhandnetworksEPSS 1.24%
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain
8.6 High severity
InRouter 302: Use of Insufficiently Random Values
CVE-2023-22601Jan 12, 2023InHand Networks
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use of Insufficiently Random Values. They do not properly randomize MQTT ClientID parameters. An unautho
8.1 High severity
InRouter 302: Improper Access Control
CVE-2023-22600Jan 12, 2023InHand Networks
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284: Improper Access Control. They allow unauthenticated devices to subscribe to MQTT topics on the same netw
9.1 Critical severity
InRouter 302: Use of a One-Way Hash with a Predictable Salt
CVE-2023-22599Jan 12, 2023InHand Networks
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-760: Use of a One-way Hash with a Predictable Salt. They send MQTT credentials in response to HTTP/HTTPS requ
7.2 High severity
InRouter 302: Improper Neutralization of Special Elements used in an OS Command
CVE-2023-22598Jan 12, 2023InHand NetworksEPSS 1.69%
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). An unauthoriz
8.8 High severity
InRouter302: Active Debug Code
CVE-2022-30543Nov 9, 2022InHand NetworksEPSS 1.11%
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to
8.1 High severity
InRouter302: Active Debug Code
CVE-2022-29888Nov 9, 2022InHand NetworksEPSS 1.62%
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulner
8.8 High severity
InRouter302: Active Debug Code
CVE-2022-28689Nov 9, 2022InHand NetworksEPSS 1.14%
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vul
9.8 Critical severity
InRouter302: Improper Access Control
CVE-2022-25932Nov 9, 2022InHand Networks
The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulnerability.
8.8 High severity
InRouter302: Use of Hard-coded Credentials
CVE-2022-27172May 12, 2022InHand NetworksEPSS 1.08%
A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request can lead to privileged operation execution. An attacker can send a sequence of requests to trigger thi
8.8 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26782May 12, 2022InHand NetworksEPSS 3.29%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26781May 12, 2022InHand NetworksEPSS 2.94%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import…
CVE-2022-26780May 12, 2022InHand NetworksEPSS 3.29%
Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26518May 12, 2022InHand NetworksEPSS 4.85%
An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tri
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26420May 12, 2022InHand NetworksEPSS 5.92%
An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26085May 12, 2022InHand NetworksEPSS 12.7%
An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger th
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26075May 12, 2022InHand NetworksEPSS 5.92%
An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr
8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26042May 12, 2022InHand NetworksEPSS 8.61%
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this v
7.2 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26007May 12, 2022InHand NetworksEPSS 5.45%
An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerabilit
7.2 High severity
InRouter302: Out-of-bounds Write
CVE-2022-26002May 12, 2022InHand NetworksEPSS 3.41%
A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigge
8.8 High severity
InRouter302: Active Debug Code
CVE-2022-25995May 12, 2022InHand NetworksEPSS 2.86%
A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnera
8.1 High severity
InRouter302: Unrestricted Upload of File with Dangerous Type
CVE-2022-21809May 12, 2022InHand NetworksEPSS 1.82%
A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.
8.8 High severity
InRouter302: Improper Access Control
CVE-2022-21182May 12, 2022InHand NetworksEPSS 1.97%
A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerab
9.1 Critical severity
Inrouter 900 Firmware: Improper Limitation of a Pathname to a Restricted Directory
CVE-2022-27277Apr 10, 2022InhandnetworksEPSS 1.37%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability via the function sub_17C08.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27276Apr 10, 2022InhandnetworksEPSS 3.57%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_10F2C. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27275Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_122D0. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27274Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_12028. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27273Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_12168. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27272Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function sub_1791C. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27271Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component python-lib. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27270Apr 10, 2022InhandnetworksEPSS 3.47%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component ipsec_secrets. This vulnerability is triggered via a crafted packet.
9.8 Critical severity
Inrouter 900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27269Apr 10, 2022InhandnetworksEPSS 3.83%
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component config_ovpn. This vulnerability is triggered via a crafted packet.