The InHand Networks IR912 and IR915 devices running firmware version V1.0.0.r20042 and earlier are affected by a command injection vulnerability in their file upload functionality. This vulnerability permits remote attackers to execute arbitrary commands as the root user by crafting malicious input to the file upload process. The vulnerability was published in June 2026, but no CVSS score or vendor remediation details have been provided. The affected versions include V1.0.0.r20042 and all earlier firmware versions, although exact version ranges are not explicitly enumerated.

Successful exploitation allows remote attackers to execute arbitrary commands with root privileges on affected devices, potentially leading to full system compromise. This could enable unauthorized control over the device and access to sensitive data or network resources. There is no evidence of exploitation in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file upload functionality and limit network exposure of affected devices to trusted users only.