Ir302 Firmware vulnerabilities

19 known vulnerabilities in Ir302 Firmware from Inhandnetworks. 19 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Ir315 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2026-38707May 28, 2026InhandnetworksEPSS 1.24%

  A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain RO

• 9.8 Critical severity

  Ir315 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2026-38704May 28, 2026InhandnetworksEPSS 1.27%

  A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtai

• 9.8 Critical severity

  Ir315 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2026-38703May 28, 2026InhandnetworksEPSS 1.24%

  A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain

• 9.8 Critical severity

  Ir315 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2026-38702May 28, 2026InhandnetworksEPSS 1.24%

  A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain

• 8.8 High severity

  InRouter302: Active Debug Code

  CVE-2022-30543Nov 9, 2022InHand NetworksEPSS 1.11%

  A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to

• 8.1 High severity

  InRouter302: Active Debug Code

  CVE-2022-29888Nov 9, 2022InHand NetworksEPSS 1.62%

  A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulner

• 8.8 High severity

  InRouter302: Active Debug Code

  CVE-2022-28689Nov 9, 2022InHand NetworksEPSS 1.14%

  A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vul

• 8.8 High severity

  InRouter302: Use of Hard-coded Credentials

  CVE-2022-27172May 12, 2022InHand NetworksEPSS 1.08%

  A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request can lead to privileged operation execution. An attacker can send a sequence of requests to trigger thi

• 8.8 High severity

  InRouter302: Out-of-bounds Write

  CVE-2022-26782May 12, 2022InHand NetworksEPSS 3.29%

  Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th

• 8.8 High severity

  InRouter302: Out-of-bounds Write

  CVE-2022-26781May 12, 2022InHand NetworksEPSS 2.94%

  Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th

• 8.8 High severity

  Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import…

  CVE-2022-26780May 12, 2022InHand NetworksEPSS 3.29%

  Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger th

• 8.8 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26518May 12, 2022InHand NetworksEPSS 4.85%

  An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tri

• 8.8 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26420May 12, 2022InHand NetworksEPSS 5.92%

  An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr

• 8.8 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26085May 12, 2022InHand NetworksEPSS 12.7%

  An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger th

• 8.8 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26075May 12, 2022InHand NetworksEPSS 5.92%

  An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to tr

• 8.8 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26042May 12, 2022InHand NetworksEPSS 8.61%

  An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this v

• 7.2 High severity

  InRouter302: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-26007May 12, 2022InHand NetworksEPSS 5.45%

  An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerabilit

• 7.2 High severity

  InRouter302: Out-of-bounds Write

  CVE-2022-26002May 12, 2022InHand NetworksEPSS 3.41%

  A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigge

• 8.8 High severity

  InRouter302: Active Debug Code

  CVE-2022-25995May 12, 2022InHand NetworksEPSS 2.86%

  A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnera