| शीर्षक | EFM ipTIME C200E 1.094 Embedded Malicious Code |
|---|
| विवरण | iux_set.cgi contains an authenticated remote code execution (RCE) vulnerability via file upload. It lives in the function that's invoked when iux_set.cgi is called with tmenu=camera and smenu=system_setup, which maps to Camera Management → System Setup in the administrator web UI. Although it carries a .cfg extension, the configuration-restore file is really a tar archive: if you place an /etc/cron.cfg inside it containing the command you want to run, that command gets written into crontab semi-permanently, and unless the device is factory-reset or a new /etc/cron.cfg is uploaded, it runs on a recurring schedule. I reproduced this on real hardware — please see the video link below. For full details, refer to the attachment links provided in the Advisory/Exploit section.
The administrator account defaults to admin/admin. On devices running factory-default settings, this vulnerability effectively becomes an unauthenticated RCE, and devices using easily guessable passwords such as admin/12345 or admin/qwerty are similarly exposed. If a device with default or weak credentials is ever reached and the malicious file is uploaded even once, the attacker can open a telnet backdoor and take full control — and since this is a camera, any footage being recorded is at risk of being exfiltrated as well. Because the payload is written to flash, the backdoor survives reboots and firmware updates and remains semi-permanently until the victim performs a factory reset. The impact is equally severe if this is chained with an authentication bypass, or if the same vulnerable code is present in other devices.
Video demonstrating that malicious commands are written to crontab on a clean device, causing the attacker's commands to run periodically and a backdoor to be opened: https://youtu.be/CRC-kXSvdYo
The video confirms that the ipTIME C200E's administrator web UI is functioning normally and that the device is running the latest firmware. It also verifies that no telnet backdoor exists at the start. After the exploit is executed and the device reboots, the ls -l /var/tmp > /tmp/captcha/pwned.txt command planted in crontab produces captcha/pwned.txt, which is accessible without authentication. The telnet backdoor opened alongside the firewall rule is also shown to be working. To demonstrate that the command runs on a recurring basis, an empty file named hello is created under /tmp and captcha/pwned.txt is shown updating as expected. Finally, the video confirms that the crontab commands continue executing even after a subsequent reboot.
Video demonstrating that an infected device remains infected after a firmware update: https://youtu.be/qdFGRSpCiY0
The firmware used was downloaded directly from the ipTIME firmware download page, with its MD5 hash printed on screen to prove it is the official latest release from the vendor. The device is in an infected state, evidenced by the open telnet backdoor. Even after flashing that latest firmware, the crontab entry remains intact and the telnet backdoor is still present.
You can download the latest firmware of c200e here: https://iptime.com/iptime/?page_id=126&uid=27391&mod=document |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link |
|---|
| उपयोगकर्ता | aissac (UID 100146) |
|---|
| सबमिशन | 12/08/2026 02:46 PM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 07:24 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403400 [EFM ipTIME C200E 1.094 System Setup iux_set.cgi अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|