Iptime Ax8004M
Monthly
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.
OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists.