EUVD-2026-54974
GHSA-6hpq-m5gp-6p39
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-accessible popen() command injection escapes the CGI process scope to full OS control, warranting S:C and C:H/I:H/A:H despite the reporter's conservative L/L/L impact ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the fname parameter of the /cgi/d.cgi CGI endpoint, where unsanitized input is passed directly to the popen() function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.
Technical ContextAI
The affected component is the CGI endpoint /cgi/d.cgi within the EFM ipTIME AX8004M router firmware version 15.09.0, identified via CPE cpe:2.3:a:efm:iptime_ax8004m:*:*:*:*:*:*:*:*. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection): the fname HTTP parameter is passed without sanitization to the C-library function popen(), which spawns a shell subprocess to execute the provided string. Because popen() inherently invokes a POSIX shell interpreter, any shell metacharacters (semicolons, backticks, $() subshells, pipes) embedded in fname are evaluated as commands rather than data. This is a classic embedded-device CGI command injection pattern common in budget consumer and SMB routers running Linux-based firmware, where CGI scripts frequently invoke system utilities via shell wrappers rather than safer exec-family calls.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As the primary compensating control, administrators should immediately disable remote (WAN-side) access to the router's web management interface; this restricts exploitation to attackers with LAN access and eliminates the highest-risk attack surface, though it does not address insider or post-compromise scenarios. If WAN management cannot be disabled, implement an upstream firewall or ACL to whitelist only trusted source IPs allowed to reach the device's HTTP/HTTPS management port, reducing opportunistic exploitation at the cost of administrative overhead. Deploying the router behind a network boundary that does not expose port 80/443 of the management interface to the internet is the most effective compensating measure. Administrators should monitor VulDB at https://vuldb.com/cve/CVE-2026-19379 and the GitHub report at https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md for any future vendor patch. If replacement is feasible, migrating to an actively supported device is the recommended long-term resolution given the vendor's non-response.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today