The vulnerability resides in the commit_vpncli_file_upload function of the /cgi/timepro.cgi script used by the VPN Service on the EFM ipTIME A8004T router. The function accepts file uploads without performing type validation or requiring any form of authentication. Based on the description, it is inferred that an attacker can upload arbitrary files to the device over the network, which may later be served or processed in a way that could facilitate further compromise. The likely attack vector is a remote network connection to the router’s web interface, allowing interaction with the vulnerable endpoint without credentials.

The flaw affects EFM ipTIME A8004T routers running firmware version 14.18.2. No other firmware releases are listed, so the issue appears limited to that single build unless newer firmware inherits the same logic.

With a CVSS score of 5.1 the vulnerability is considered moderate. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet publicly available exploit code exists. Therefore, an opportunistic remote attacker who can reach the router may deploy malicious files, and if those files are later processed or served, the risk of further compromise rises even though execution is not explicitly confirmed by the description.