| 제목 | EFM ipTIME A3004T Version 14.20.8 and earlier Authentication Bypass and Arbitrary File Upload |
|---|
| 설명 | There is a critical security vulnerability in the ipTIME router firmware involving the timepro.cgi binary file.
First, the ftext scheduler in the timepro.cgi binary file contains an authentication bypass flaw when processing URL paths: an attacker can bypass session authentication logic by replacing the standard /sess-bin/ path prefix with /cgi/, thereby gaining direct access to sensitive CGI functions that would otherwise require authentication.
Second, the `commit_vpncli_file_upload` function lacks an effective file validation mechanism and does not perform validity checks on the file extensions or contents of uploaded files, allowing an attacker to upload arbitrary files to the system directory `/etc/econf/vpnclient/openvpn/`.
An attacker can bypass authentication to call this function and upload a malicious OpenVPN configuration file containing the `script-security 2` directive or higher. When the system calls the VPN service to load this configuration, the OpenVPN process will execute the malicious script in the configuration file with root privileges, ultimately enabling unauthenticated remote root-level arbitrary command execution. |
|---|
| 원천 | ⚠️ https://github.com/AdminSafe/CVE/issues/4 |
|---|
| 사용자 | 010hex (UID 99386) |
|---|
| 제출 | 2026. 07. 02. PM 01:51 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 23. PM 04:09 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 391156 [EFM ipTIME A3004T 14.19.0 Session Validation httpcon_check_session_url 약한 인증] |
|---|
| 포인트들 | 0 |
|---|