Description

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-10T01:16:47.980Z",
  "pubdate": "2026-08-10T01:16:47.980Z",
  "executiveSummary": "An OS command injection vulnerability has been identified in the EFM ipTIME AX8004M router running firmware version 15.09.0. The vulnerability resides within the CGI Endpoint component, specifically inside the popen function handling requests to the /cgi/d.cgi file.\nThe flaw stems from improper sanitization and neutralization of user-supplied input passed directly into the fname argument. Remote unauthenticated attackers can leverage this weakness to execute arbitrary operating system commands with the privileges of the underlying web server or application process.\nThe impact of this vulnerability is critical, potentially leading to complete system compromise, unauthorized access to internal network resources, interception of sensitive data, and the establishment of persistent backdoors within the targeted network architecture.\nPublic disclosure of the exploit increases the risk profile of affected devices, especially considering the vendor's lack of response and non-availability of official patches. Immediate defensive measures and compensatory hardening controls must be deployed to mitigate potential exploitation risks.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the CGI Endpoint component of the EFM ipTIME AX8004M firmware version 15.09.0. Specifically, the vulnerability manifests in the binary handling the /cgi/d.cgi endpoint, where user-supplied input destined for the fname argument is passed directly and unsanitized into the popen function.\nFrom an architectural standpoint, the root cause is a failure in input validation and lack of argument separation. When processing an HTTP request directed at /cgi/d.cgi, the application extracts the parameter value associated with fname. Instead of utilizing safe API wrappers or implementing strict allow-listing of expected inputs, the application concatenates the tainted input string directly into a command execution sink managed by the popen system call.\nThe attack flow proceeds as follows: an adversary crafts a malicious HTTP request targeting the exposed /cgi/d.cgi endpoint. Within the query string or POST data, the attacker injects shell metacharacters (such as semicolons, pipe symbols, or backticks) followed by arbitrary system commands into the fname parameter. When the web application invokes the popen function with the concatenated string, the underlying shell interprets the injected metacharacters and executes the attacker's payload.\nThis vulnerability is exploitable remotely over the network without requiring prior authentication or privileged access, assuming the management interface or vulnerable CGI endpoint is accessible to the attacker. The execution context inherits the privilege level of the web server process, which often operates with elevated system privileges on embedded router devices.\nSuccessful exploitation results in post-exploitation scenarios that include full remote code execution, manipulation of firmware configurations, denial of service via system crashes, and lateral movement into the local area network protected by the device."
}