Description
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-09-15
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution via OS command injection
Action: Assess Impact
AI Analysis

Impact

A remote attacker can manipulate parameters used by the iux_set.cgi web component, enabling execution of arbitrary operating system commands on the device. The flaw allows remote code execution, which can compromise confidentiality, integrity, and availability of the affected system. The weakness is a classic OS command injection, as identified by CWE-77 and CWE-78.

Affected Systems

The vulnerability affects EFM ipTIME C200E routers running firmware version 1.094. No other versions or products are indicated as impacted.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, likely via HTTP requests to the /iux_set.cgi endpoint, and can be performed without authentication according to the publicly disclosed exploit. Remediation requires firmware updates or mitigations until a patch is released.

Generated by OpenCVE AI on September 15, 2026 at 09:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the device firmware version and determine if 1.094 is in use; if so, consult the vendor’s website for a firmware update that addresses this OS command injection flaw.
  • Once an updated firmware is available, apply the patch following the manufacturer’s instructions to eliminate the injection point.
  • If no update is available, restrict external access to the device by placing it behind a firewall, limiting HTTP/S connections, and monitoring logs for unexpected iux_set.cgi activity.

Generated by OpenCVE AI on September 15, 2026 at 09:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title EFM ipTIME C200E System Setup iux_set.cgi os command injection
First Time appeared Efm
Efm iptime C200e
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:efm:iptime_c200e:*:*:*:*:*:*:*:*
Vendors & Products Efm
Efm iptime C200e
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Efm Iptime C200e
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T01:00:13.115Z

Reserved: 2026-09-14T05:23:56.580Z

Link: CVE-2026-90847

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-15T01:16:54.423

Modified: 2026-09-15T01:16:54.423

Link: CVE-2026-90847

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T09:45:17Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')