Efm
Monthly
OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Authentication bypass in EFM ipTIME A3004T (firmware 14.19.0) lets remote attackers defeat session validation through the httpcon_check_session_url function, granting unauthorized access to the router's web management interface. Publicly available exploit code exists, though the flaw is not yet listed in CISA KEV. The vendor was notified but did not respond, so no fix is currently available.
Stack-based buffer overflow in ipTIME A8004T router firmware 14.18.2 enables authenticated remote attackers to achieve complete system compromise via malformed WiFi configuration requests. The vulnerability exists in the formWifiBasicSet function's handling of the security_5g parameter. Public exploit code (GitHub POC) increases exploitation risk, though EPSS data and active exploitation status are not available. Vendor (EFM Networks) has not responded to disclosure or released a patch.
Stack-based buffer overflow in EFM ipTIME NAS1dual 1.5.24 allows remote unauthenticated attackers to achieve complete system compromise via the get_csrf_whites function in /cgi/advanced/misc_main.cgi. Public exploit code exists on GitHub, demonstrating practical exploitability despite lack of vendor response to responsible disclosure. CVSS 8.9 (Critical) with EPSS data unavailable; attack requires no authentication, low complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N), making this a high-priority remote attack surface.
Remote command injection in EFM ipTIME C200 camera firmware (versions up to 1.092) allows authenticated administrators to execute arbitrary system commands via malicious file upload to the ApplyRestore endpoint. The vulnerability exists in the sub_408F90 function processing the RestoreFile parameter in /cgi/iux_set.cgi. Exploitation probability is elevated by publicly available proof-of-concept code demonstrating the attack technique, though no active exploitation has been confirmed by CISA KEV at time of analysis. Vendor has been unresponsive to disclosure attempts, indicating no official patch timeline.
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.
OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Authentication bypass in EFM ipTIME A3004T (firmware 14.19.0) lets remote attackers defeat session validation through the httpcon_check_session_url function, granting unauthorized access to the router's web management interface. Publicly available exploit code exists, though the flaw is not yet listed in CISA KEV. The vendor was notified but did not respond, so no fix is currently available.
Stack-based buffer overflow in ipTIME A8004T router firmware 14.18.2 enables authenticated remote attackers to achieve complete system compromise via malformed WiFi configuration requests. The vulnerability exists in the formWifiBasicSet function's handling of the security_5g parameter. Public exploit code (GitHub POC) increases exploitation risk, though EPSS data and active exploitation status are not available. Vendor (EFM Networks) has not responded to disclosure or released a patch.
Stack-based buffer overflow in EFM ipTIME NAS1dual 1.5.24 allows remote unauthenticated attackers to achieve complete system compromise via the get_csrf_whites function in /cgi/advanced/misc_main.cgi. Public exploit code exists on GitHub, demonstrating practical exploitability despite lack of vendor response to responsible disclosure. CVSS 8.9 (Critical) with EPSS data unavailable; attack requires no authentication, low complexity, and no user interaction (AV:N/AC:L/PR:N/UI:N), making this a high-priority remote attack surface.
Remote command injection in EFM ipTIME C200 camera firmware (versions up to 1.092) allows authenticated administrators to execute arbitrary system commands via malicious file upload to the ApplyRestore endpoint. The vulnerability exists in the sub_408F90 function processing the RestoreFile parameter in /cgi/iux_set.cgi. Exploitation probability is elevated by publicly available proof-of-concept code demonstrating the attack technique, though no active exploitation has been confirmed by CISA KEV at time of analysis. Vendor has been unresponsive to disclosure attempts, indicating no official patch timeline.
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.