Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ipTIME C200E by EFM
CVE-2026-90847 (GCVE-0-2026-90847)
Vulnerability from nvd – Published: 2026-09-15 01:00 – Updated: 2026-09-15 19:05
VLAI
EPSS
VEX
Title
EFM ipTIME C200E System Setup iux_set.cgi os command injection
Summary
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity
9.1 (Critical)
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:05 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403400 | vdb-entry |
| https://vuldb.com/vuln/403400/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90847 | third-party-advisory |
| https://vuldb.com/submit/925831 | third-party-advisory |
| https://drive.google.com/file/d/19WVo2tOImpmSEg3d… | related |
| https://youtu.be/qdFGRSpCiY0 | exploitmedia-coverage |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EFM | ipTIME C200E |
Affected:
1.094
cpe:2.3:a:efm:iptime_c200e:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90847",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:05:28.206271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:05:36.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:efm:iptime_c200e:*:*:*:*:*:*:*:*"
],
"modules": [
"System Setup"
],
"product": "ipTIME C200E",
"vendor": "EFM",
"versions": [
{
"status": "affected",
"version": "1.094"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aissac (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T01:00:13.115Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403400 | EFM ipTIME C200E System Setup iux_set.cgi os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403400"
},
{
"name": "VDB-403400 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403400/cti"
},
{
"name": "CVE-2026-90847 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90847"
},
{
"name": "Submit #925831 | EFM ipTIME C200E 1.094 Embedded Malicious Code",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/925831"
},
{
"tags": [
"related"
],
"url": "https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link"
},
{
"tags": [
"exploit",
"media-coverage"
],
"url": "https://youtu.be/qdFGRSpCiY0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-14T07:29:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "EFM ipTIME C200E System Setup iux_set.cgi os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90847",
"datePublished": "2026-09-15T01:00:13.115Z",
"dateReserved": "2026-09-14T05:23:56.580Z",
"dateUpdated": "2026-09-15T19:05:36.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90847 (GCVE-0-2026-90847)
Vulnerability from cvelistv5 – Published: 2026-09-15 01:00 – Updated: 2026-09-15 19:05
VLAI
EPSS
VEX
Title
EFM ipTIME C200E System Setup iux_set.cgi os command injection
Summary
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity
9.1 (Critical)
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:05 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403400 | vdb-entry |
| https://vuldb.com/vuln/403400/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90847 | third-party-advisory |
| https://vuldb.com/submit/925831 | third-party-advisory |
| https://drive.google.com/file/d/19WVo2tOImpmSEg3d… | related |
| https://youtu.be/qdFGRSpCiY0 | exploitmedia-coverage |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EFM | ipTIME C200E |
Affected:
1.094
cpe:2.3:a:efm:iptime_c200e:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90847",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:05:28.206271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:05:36.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:efm:iptime_c200e:*:*:*:*:*:*:*:*"
],
"modules": [
"System Setup"
],
"product": "ipTIME C200E",
"vendor": "EFM",
"versions": [
{
"status": "affected",
"version": "1.094"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aissac (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T01:00:13.115Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403400 | EFM ipTIME C200E System Setup iux_set.cgi os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403400"
},
{
"name": "VDB-403400 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403400/cti"
},
{
"name": "CVE-2026-90847 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90847"
},
{
"name": "Submit #925831 | EFM ipTIME C200E 1.094 Embedded Malicious Code",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/925831"
},
{
"tags": [
"related"
],
"url": "https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link"
},
{
"tags": [
"exploit",
"media-coverage"
],
"url": "https://youtu.be/qdFGRSpCiY0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-14T07:29:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "EFM ipTIME C200E System Setup iux_set.cgi os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90847",
"datePublished": "2026-09-15T01:00:13.115Z",
"dateReserved": "2026-09-14T05:23:56.580Z",
"dateUpdated": "2026-09-15T19:05:36.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}