| Titre | IPtime ipTIME AX8004M AX8004M 15.09.0 Arbitrary File Read |
|---|
| Description | Vendor: ipTIME (EFM Networks Co., Ltd.) Product: ipTIME AX8004M Wireless Router Firmware Version: 15.09.0 Vulnerability Type: Unauthenticated Arbitrary File Read & OS Command Injection
Overview An unauthenticated arbitrary file read and OS command injection vulnerability was identified in the ipTIME AX8004M wireless router. A remote attacker without authentication can send a crafted HTTP GET request to the /cgi/d.cgi endpoint to read arbitrary system files and execute arbitrary OS commands on the target device. The authentication mechanism relies on a hardcoded magic key embedded in the firmware, which can be trivially extracted.
Vulnerability Details The vulnerability resides in the CGI binary /cgi/d.cgi (located at home/httpd/cgi/d.cgi in firmware). The CGI script accepts a user-supplied fname GET parameter and passes it directly to fopen() without any path sanitization, allowing an attacker to read arbitrary files on the filesystem (e.g., /etc/passwd, /etc/shadow, configuration files containing credentials).
When the file read mode is not triggered, the CGI falls through to a command execution branch that passes attacker-controlled input to popen(), enabling arbitrary OS command execution on the underlying Linux system.
The CGI relies on a hardcoded "magic key" parameter (aaksjdkfj=!@dnjsrurelqjrm*&) that is embedded in the firmware. There is no session-based authentication or access control protecting the endpoint. |
|---|
| La source | ⚠️ https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md |
|---|
| Utilisateur | CC.05 (UID 99206) |
|---|
| Soumission | 23/06/2026 19:55 (il y a 2 mois) |
|---|
| Modérer | 09/08/2026 17:09 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 387272 [EFM ipTIME AX8004M 15.09.0 CGI Endpoint /cgi/d.cgi popen fname élévation de privilèges] |
|---|
| Points | 20 |
|---|