CVE-2026-38708 is a command injection vulnerability affecting specific versions of TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 devices. The flaw exists in the system.setclock interface, where crafted input can lead to execution of arbitrary commands as root. This vulnerability is identified as CWE-77 and has a critical CVSS 3.1 base score of 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary commands with root privileges on affected devices, potentially leading to full system compromise, data theft, or disruption of device functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict network access to the affected devices and monitor for suspicious activity targeting the system.setclock interface.