EFM ipTIME C200E EUVD-2026-78242

Exploitation requires: (1) administrative (PR:H) authentication to the device's web management interface - the vulnerability resides in the System Setup component (iux_set.cgi), which is gated behind admin login; (2) network reachability to the device's HTTP/HTTPS management port (AV:N). No user interaction is required beyond the authenticated session. What limits exploitation: the admin credential requirement is the primary barrier - attackers must first obtain valid admin credentials via credential theft, brute force, default password reuse, or a separate auth bypass. The device must be network-accessible; LAN-only deployments with no external exposure significantly reduce risk. No exploit automation infrastructure (botnet, scanner) leveraging this specific flaw has been reported at time of analysis.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N yielding 8.5 correctly reflects the key mitigating factor: PR:H (high privileges required), meaning an attacker must already possess administrative credentials to the device's web interface. This substantially reduces real-world risk compared to a PR:N scenario. EPSS data is not provided in the input, and this CVE has not appeared in CISA KEV. The publicly available POC (YouTube video, Google Drive) lowers the exploitation skill bar for any attacker who already has admin access. The CVSS 4.0 scope indicators (SC:H/SI:H/SA:H) correctly model that successful exploitation crosses from the web application into the underlying embedded OS, enabling full device takeover. Real-world priority is moderate: the authentication prerequisite limits opportunistic mass exploitation, but targeted attacks against organizations using this device - especially those with default or weak admin credentials - are plausible. The combined high impact across confidentiality, integrity, and availability of both vulnerable and subsequent systems confirms that successful exploitation is devastating, but getting to that point requires credential access first.

An attacker who has obtained or guessed the administrative credentials for the ipTIME C200E web interface sends a crafted POST request to /iux_set.cgi with injected shell metacharacters in a system configuration parameter. The embedded CGI interpreter passes the unsanitized input to a system() or popen() call on the device OS, executing the attacker's payload - such as a reverse shell or persistent backdoor - with the privileges of the web server process, which on embedded devices is typically root. A public video PoC demonstrating this technique is available at https://youtu.be/qdFGRSpCiY0.