ipTIME NAS1dual EUVD-2026-27333

No special conditions - remote unauthenticated exploitation against default configurations of ipTIME NAS1dual. The CVSS vector confirms attack requirements: network accessibility (AV:N) to the web management interface, no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L). Exploitation requires only that the device's CGI interface at /cgi/advanced/misc_main.cgi be reachable over TCP/IP, which is typical for default NAS configurations where web management is enabled. The vulnerable get_csrf_whites function appears to be accessible without authentication, suggesting it may be part of pre-authentication CSRF protection logic ironically containing the vulnerability. No specific non-default features, services, or configuration changes are mentioned as prerequisites in the available data. Attack surface exists on any internet-facing deployment or from internal network positions if the device is deployed on corporate LANs. The attack is limited to ipTIME NAS1dual version 1.5.24 and potentially related versions indicated by the CPE wildcard; other ipTIME models or firmware versions are not confirmed affected based on available data.

This represents an elevated real-world risk despite limited data signals. CVSS 8.9 accurately reflects the technical severity: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and complete system impact (VC/VI/VA:H). The CVSS 4.0 Exploit Maturity indicator shows E:P (Proof-of-concept), confirmed by the publicly available GitHub repository containing exploitation details. However, critical risk signals are missing: no CISA KEV listing suggests this is not yet observed in widespread active exploitation, and EPSS probability data is unavailable for comparative risk assessment. The vendor's non-responsiveness to disclosure is concerning, indicating likely absence of official patches. Real-world risk factors favoring exploitation: unauthenticated remote vector, public POC, embedded device unlikely to receive automatic updates. Risk factors limiting exploitation: appears to be an IoT/embedded device with potentially limited deployment compared to enterprise infrastructure, and successful exploitation may require knowledge of specific input formatting to trigger the overflow. Priority assessment: High for organizations using ipTIME NAS devices; Medium-Low for general enterprise environments unless this specific hardware is deployed. The combination of remote unauthenticated access and public exploit code mandates immediate attention from affected users, but absence from CISA KEV suggests targeted rather than mass exploitation patterns currently.

An external attacker identifies an ipTIME NAS1dual device exposed to the Internet through port scanning or IoT search engines like Shodan. The attacker sends a specially crafted HTTP request to /cgi/advanced/misc_main.cgi targeting the get_csrf_whites function with oversized input parameters that exceed the stack buffer allocation. The overflow overwrites the function's return address with attacker-controlled values, redirecting execution to injected shellcode. The attacker gains root-level code execution on the embedded Linux system, enabling data exfiltration of stored files, installation of persistent backdoors, or pivoting to other devices on the victim's internal network. Public proof-of-concept code on GitHub (https://github.com/glkfc/IoT-Vulnerability/blob/main/iptime/nas1dual/iptime2_en.md) provides technical details for exploitation, lowering the skill barrier for attack.