| Title | IPtime ipTIME AX8004M AX8004M 15.09.0 Arbitrary File Read |
|---|
| Description | Vendor: ipTIME (EFM Networks Co., Ltd.) Product: ipTIME AX8004M Wireless Router Firmware Version: 15.09.0 Vulnerability Type: Unauthenticated Arbitrary File Read & OS Command Injection
Overview An unauthenticated arbitrary file read and OS command injection vulnerability was identified in the ipTIME AX8004M wireless router. A remote attacker without authentication can send a crafted HTTP GET request to the /cgi/d.cgi endpoint to read arbitrary system files and execute arbitrary OS commands on the target device. The authentication mechanism relies on a hardcoded magic key embedded in the firmware, which can be trivially extracted.
Vulnerability Details The vulnerability resides in the CGI binary /cgi/d.cgi (located at home/httpd/cgi/d.cgi in firmware). The CGI script accepts a user-supplied fname GET parameter and passes it directly to fopen() without any path sanitization, allowing an attacker to read arbitrary files on the filesystem (e.g., /etc/passwd, /etc/shadow, configuration files containing credentials).
When the file read mode is not triggered, the CGI falls through to a command execution branch that passes attacker-controlled input to popen(), enabling arbitrary OS command execution on the underlying Linux system.
The CGI relies on a hardcoded "magic key" parameter (aaksjdkfj=!@dnjsrurelqjrm*&) that is embedded in the firmware. There is no session-based authentication or access control protecting the endpoint. |
|---|
| Source | ⚠️ https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md |
|---|
| User | CC.05 (UID 99206) |
|---|
| Submission | 06/23/2026 19:55 (2 months ago) |
|---|
| Moderation | 08/09/2026 17:09 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 387272 [EFM ipTIME AX8004M 15.09.0 CGI Endpoint /cgi/d.cgi popen fname os command injection] |
|---|
| Points | 20 |
|---|