| 标题 | IPtime ipTIME AX8004M AX8004M 15.09.0 Arbitrary File Read |
|---|
| 描述 | Vendor: ipTIME (EFM Networks Co., Ltd.) Product: ipTIME AX8004M Wireless Router Firmware Version: 15.09.0 Vulnerability Type: Unauthenticated Arbitrary File Read & OS Command Injection
Overview An unauthenticated arbitrary file read and OS command injection vulnerability was identified in the ipTIME AX8004M wireless router. A remote attacker without authentication can send a crafted HTTP GET request to the /cgi/d.cgi endpoint to read arbitrary system files and execute arbitrary OS commands on the target device. The authentication mechanism relies on a hardcoded magic key embedded in the firmware, which can be trivially extracted.
Vulnerability Details The vulnerability resides in the CGI binary /cgi/d.cgi (located at home/httpd/cgi/d.cgi in firmware). The CGI script accepts a user-supplied fname GET parameter and passes it directly to fopen() without any path sanitization, allowing an attacker to read arbitrary files on the filesystem (e.g., /etc/passwd, /etc/shadow, configuration files containing credentials).
When the file read mode is not triggered, the CGI falls through to a command execution branch that passes attacker-controlled input to popen(), enabling arbitrary OS command execution on the underlying Linux system.
The CGI relies on a hardcoded "magic key" parameter (aaksjdkfj=!@dnjsrurelqjrm*&) that is embedded in the firmware. There is no session-based authentication or access control protecting the endpoint. |
|---|
| 来源 | ⚠️ https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md |
|---|
| 用户 | CC.05 (UID 99206) |
|---|
| 提交 | 2026-06-23 19時55分 (2 月前) |
|---|
| 管理 | 2026-08-09 17時09分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 387272 [EFM ipTIME AX8004M 15.09.0 CGI Endpoint /cgi/d.cgi popen fname 权限提升] |
|---|
| 积分 | 20 |
|---|