CVE-2026-38713 identifies a command injection vulnerability in the ipsec_conn interface of several TR and WR device models and versions. This vulnerability permits an attacker to execute arbitrary commands with root privileges by supplying specially crafted input to the vulnerable interface. The affected versions are explicitly listed but no patch or remediation level has been disclosed. The vulnerability is publicly known but no CVSS score or exploit reports are available.

Successful exploitation results in arbitrary command execution as root, which can lead to full system compromise of the affected devices. This poses a critical security risk as attackers could gain complete control over the device and potentially the network it operates within.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ipsec_conn interface and monitor for suspicious activity related to this interface. Avoid exposing affected devices to untrusted networks.