ipTIME AX8004M CVE-2026-19379

The attack requires network-accessible reach to the router's HTTP CGI interface at /cgi/d.cgi - no authentication is required per the CVSS 4.0 PR:N metric. The fname parameter must be supplied in the HTTP request to trigger the vulnerable popen() call. Firmware version 15.09.0 is confirmed vulnerable; additional versions are not independently confirmed but are suggested by the wildcard CPE. Exploitation is limited by whether the management interface is reachable: devices where WAN-side web management is disabled restrict the attack to LAN-adjacent or already-compromised-network adversaries. No non-default configuration, special feature flag, or authenticated session is required based on available data. The E:P exploit maturity flag in the CVSS 4.0 vector confirms a proof-of-concept exists, removing tool-development as a barrier.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P scores 6.9 (Medium), but the stated impact metrics VC:L/VI:L/VA:L appear significantly underestimated for an unauthenticated OS command injection vulnerability - arbitrary command execution on an embedded Linux router typically enables full device compromise including credential harvesting, persistent implant installation, and LAN pivoting. The E:P flag in the CVSS 4.0 vector explicitly confirms publicly available proof-of-concept exploit code on GitHub, which substantially lowers the skill barrier for exploitation. No CISA KEV listing was present in the provided data, and no EPSS score was supplied - exploitation at scale is not confirmed, but the PoC and vendor non-response increase the likelihood of opportunistic targeting. The vendor's failure to respond to disclosure means no official patch exists and no vendor advisory is forthcoming, leaving defenders with no authoritative mitigation path. The wildcard version in the CPE string suggests that additional firmware versions beyond 15.09.0 may also be affected, though this is not independently confirmed. Real-world risk is meaningfully higher than the CVSS score implies for any deployment with the management interface internet-accessible.

An unauthenticated attacker with network access to the router's management interface sends a crafted HTTP GET or POST request to /cgi/d.cgi with the fname parameter containing shell metacharacters, such as fname=legit;id;whoami or a reverse shell payload. The firmware's CGI handler passes the unsanitized value directly to popen(), which executes the injected commands in a shell context on the router's embedded Linux OS. With a public proof-of-concept available on GitHub, this scenario is accessible to low-skilled attackers targeting internet-facing ipTIME AX8004M devices.