ipTIME A8004T EUVD-2026-28987

Requires authenticated access to the ipTIME A8004T web management interface, specifically low-privilege credentials (CVSS PR:L). The /goform/WifiBasicSet endpoint must be network-accessible, which is default configuration when web management is enabled. Exploitation targets the security_5g parameter in WiFi configuration requests, so the router must support 5GHz wireless configuration (standard for A8004T model). No special deployment mode or non-default configuration is required beyond the router's standard web interface being active. The authenticated requirement is a limiting factor, but routers commonly ship with default credentials (admin/admin or similar) that users rarely change, effectively reducing PR:L to a minor barrier. No user interaction (UI:N) is required beyond the attacker's own HTTP requests. Exploitation is not limited by specific client-side conditions, browser versions, or timing windows.

Real-world risk is HIGH despite no confirmed active exploitation. CVSS 7.4 (High severity) aligns with the technical reality: network-reachable attack vector, low attack complexity, and complete system compromise (VC:H/VI:H/VA:H). The PR:L (low privilege required) means attackers need authenticated access to the router's web interface - typically achievable through default credentials, credential stuffing, or prior compromise. Public POC availability on GitHub significantly lowers the skill barrier for exploitation. The lack of vendor response or patch creates an indefinite exposure window for all ipTIME A8004T 14.18.2 devices. EPSS score unavailable, and no CISA KEV listing suggests exploitation is not yet widespread, but the combination of public exploit code and unpatched status makes this a priority for organizations using this router model. Stack-based buffer overflows in router firmware commonly enable remote code execution with root privileges, allowing complete device takeover, traffic interception, and network pivoting.

An attacker scans for ipTIME A8004T routers exposed on the internet and identifies the web management interface. Using default credentials (admin/admin) or credentials from previous breaches, the attacker authenticates to the router's admin panel. They craft a malicious HTTP POST request to /goform/WifiBasicSet with an oversized security_5g parameter (e.g., 1000+ bytes) containing shellcode. The formWifiBasicSet function copies this unchecked input to a stack buffer, overwriting the return address with the attacker's controlled value. Upon function return, execution jumps to the injected shellcode running with root privileges, granting the attacker full control of the router to intercept traffic, pivot to internal networks, or install persistent backdoors. Public POC code at GitHub (Kiciot/cve/issues/5) provides ready-made exploitation tooling.