CVE-2026-1741: falha de alta gravidade em EFM ipTIME A8004T
EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
EFM · ipTIME A8004TCVEs relacionadas — EFM ipTIME A8004T
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1740MEDIUMEFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authenticationEPSS 0.5%CVE-2026-8234HIGHEFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflowEPSS 0.5%CVE-2026-1742MEDIUMEFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.4%