CVE-2026-38713 is a command injection vulnerability affecting specific versions of TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 devices. The vulnerability exists in the ipsec_conn interface and allows remote attackers to execute arbitrary commands as root via crafted input. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). No patch or official remediation level has been published by the vendor, and no known exploits have been reported in the wild.

Successful exploitation results in full root command execution on affected devices, compromising confidentiality, integrity, and availability. This could allow attackers to take complete control of the device remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the ipsec_conn interface and monitor for suspicious activity related to command injection attempts.