CVE-2026-7833 in ipTIME C200
Summary
by MITRE • 05/05/2026
A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component ApplyRestore Endpoint. This manipulation of the argument RestoreFile causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/26/2026
The EFM ipTIME C200 router model presents a critical command injection vulnerability within its web interface administration system that affects firmware versions up to 1.092. This flaw exists in the ApplyRestore Endpoint functionality located at /cgi/iux_set.cgi where the sub_408F90 function processes user input without proper sanitization or validation. The vulnerability specifically manifests when handling the RestoreFile argument, which allows malicious actors to inject arbitrary commands that execute with the privileges of the web server process. This represents a severe security weakness that directly violates multiple cybersecurity standards and best practices.
The technical implementation of this vulnerability stems from insufficient input validation mechanisms within the router's firmware codebase, creating an environment where unfiltered user-supplied data can be interpreted as executable commands rather than simple data inputs. The affected function sub_408F90 operates in a manner consistent with CWE-77 standards for command injection vulnerabilities, where user-controllable parameters are directly concatenated into system execution calls without proper escaping or sanitization. This allows attackers to craft malicious payloads that bypass normal input restrictions and execute arbitrary system commands on the affected device.
The operational impact of this vulnerability extends far beyond simple data compromise, as remote exploitation enables attackers to gain full control over the affected router's functionality. Successful exploitation could allow adversaries to modify network configurations, redirect traffic through malicious proxies, establish backdoors for persistent access, or use the device as a launch point for further attacks against internal networks. The availability of public exploits for this vulnerability significantly increases the risk surface, as it removes the requirement for advanced technical skills typically needed to develop custom attack vectors. This aligns with ATT&CK framework techniques related to remote code execution and privilege escalation within network infrastructure devices.
Security professionals should implement immediate mitigations including firmware updates from the vendor when available, network segmentation to isolate affected devices, and monitoring for suspicious traffic patterns that might indicate exploitation attempts. The lack of vendor response to early disclosure efforts suggests potential gaps in the manufacturer's security incident response procedures, which may require additional defensive measures such as network-based intrusion detection system rules specifically targeting this vulnerability pattern. Organizations should also consider implementing device authentication mechanisms and disabling unnecessary administrative services to reduce the attack surface while awaiting official patches that address the root cause of the command injection vulnerability within the router's web administration interface.