| 제목 | IPtime ipTIME AX8004M AX8004M 15.09.0 Arbitrary File Read |
|---|
| 설명 | Vendor: ipTIME (EFM Networks Co., Ltd.) Product: ipTIME AX8004M Wireless Router Firmware Version: 15.09.0 Vulnerability Type: Unauthenticated Arbitrary File Read & OS Command Injection
Overview An unauthenticated arbitrary file read and OS command injection vulnerability was identified in the ipTIME AX8004M wireless router. A remote attacker without authentication can send a crafted HTTP GET request to the /cgi/d.cgi endpoint to read arbitrary system files and execute arbitrary OS commands on the target device. The authentication mechanism relies on a hardcoded magic key embedded in the firmware, which can be trivially extracted.
Vulnerability Details The vulnerability resides in the CGI binary /cgi/d.cgi (located at home/httpd/cgi/d.cgi in firmware). The CGI script accepts a user-supplied fname GET parameter and passes it directly to fopen() without any path sanitization, allowing an attacker to read arbitrary files on the filesystem (e.g., /etc/passwd, /etc/shadow, configuration files containing credentials).
When the file read mode is not triggered, the CGI falls through to a command execution branch that passes attacker-controlled input to popen(), enabling arbitrary OS command execution on the underlying Linux system.
The CGI relies on a hardcoded "magic key" parameter (aaksjdkfj=!@dnjsrurelqjrm*&) that is embedded in the firmware. There is no session-based authentication or access control protecting the endpoint. |
|---|
| 원천 | ⚠️ https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md |
|---|
| 사용자 | CC.05 (UID 99206) |
|---|
| 제출 | 2026. 06. 23. PM 07:55 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 09. PM 05:09 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 387272 [EFM ipTIME AX8004M 15.09.0 CGI Endpoint /cgi/d.cgi popen fname 권한 상승] |
|---|
| 포인트들 | 20 |
|---|