The vulnerability is a stack‑based buffer overflow in the formWifiBasicSet function of the ipTIME A8004T router firmware 14.18.2; it is triggered by sending a malicious input to the security_5g parameter in the /goform/WifiBasicSet endpoint, allowing an attacker to overflow the call stack and potentially execute arbitrary code or other malicious actions, all without authentication and reachable from any device that can communicate with the router’s management interface; the flaw was publicly disclosed and may be used, but the vendor has not responded, increasing the window of opportunity for attackers; a successful exploit would compromise the confidentiality, integrity, and availability of the router, potentially exposing the internal network to remote attackers.

EFM:ipTIME A8004T routers running firmware 14.18.2 are affected, and no other versions are listed as vulnerable.

The vulnerability carries a CVSS score of 8.7, indicating high severity; the EPSS score is not available so the exact exploitation probability is unknown, but public disclosure and lack of a vendor patch suggest a moderate‑to‑high real‑world risk; it is not yet listed in CISA KEV; attackers can deliver the malicious payload via a crafted POST request to /goform/WifiBasicSet from any host that can reach the router, making remote exploitation realistic.