A1 Firmware
CVE-2025-55423
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
AnalysisAI
Multiple ipTIME router models have a command injection vulnerability in the upnp_relay() function, allowing remote attackers to execute arbitrary OS commands through crafted UPnP requests.
Technical ContextAI
The upnp_relay() function in multiple ipTIME routers fails to sanitize UPnP control messages (CWE-94), allowing attackers to inject OS commands through crafted UPnP requests processed by the router.
RemediationAI
Update router firmware. Disable UPnP if not needed. ipTIME routers should be checked for firmware updates regularly.
More in A1 Firmware
View allLack of authentication vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no aut
Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Midd
Same weakness CWE-94 – Code Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today