Iptime C200E
Monthly
OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.
OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.