Description
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-16
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via unrestricted file upload
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located in the commit_vpncli_file_upload function of /cgi/timepro.cgi on the EFM iptime A6004MX 14.18.2 firmware. An attacker can upload an arbitrary file without any checks, allowing potential execution of malicious code or injection of unauthorized content. The flaw is classified as an Access Control weakness (CWE-284) and an Unrestricted Upload of File (CWE-434). The CVSS score of 9.3 reflects its high impact on confidentiality, integrity, and availability.

Affected Systems

The affected devices are the EFM iptime A6004MX routers running firmware version 14.18.2. No other firmware versions or models are listed in the CNA data, so only the specified model and version should be considered at risk.

Risk and Exploitability

The flaw is exploitable remotely by sending a crafted HTTP request to the /cgi/timepro.cgi endpoint. An attacker can upload a malicious script or executable, potentially leading to remote code execution. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation, but a public exploit exists, and the vulnerability is not currently in the CISA KEV catalog. Nevertheless, given the severity score, an attacker could compromise the device if the endpoint remains exposed.

Generated by OpenCVE AI on April 17, 2026 at 19:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s official firmware update that patches the unrestricted upload in commit_vpncli_file_upload once released.
  • Restrict access to /cgi/timepro.cgi by enforcing authentication and limiting it to trusted internal networks.
  • Configure the web server or device to accept only vetted file types for upload, rejecting all other content, thereby mitigating the risk of arbitrary code execution.

Generated by OpenCVE AI on April 17, 2026 at 19:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 17 Feb 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Iptime
Iptime a6004mx
Vendors & Products Iptime
Iptime a6004mx

Mon, 16 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload
Weaknesses CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Iptime A6004mx
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:08:20.919Z

Reserved: 2026-02-15T16:12:46.592Z

Link: CVE-2026-2550

cve-icon Vulnrichment

Updated: 2026-02-17T14:59:34.840Z

cve-icon NVD

Status : Deferred

Published: 2026-02-16T10:16:08.623

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-2550

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T19:15:26Z

Weaknesses