CVE-2026-1742
Unrestricted File Upload in EFM ipTIME A8004T VPN Service
Publication date: 2026-02-02
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| iptime | a8004t_firmware | 14.18.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to upload arbitrary files and execute commands with root privileges, leading to full system compromise. This can result in unauthorized access to sensitive data, potentially impacting confidentiality, integrity, and availability of information.
Such security weaknesses can hinder compliance with common standards and regulations like GDPR and HIPAA, which require adequate protection of personal and sensitive data against unauthorized access and system compromise.
However, the provided information does not explicitly mention specific impacts or assessments related to compliance with these standards.
Can you explain this vulnerability to me?
CVE-2026-1742 is a vulnerability in the EFM ipTIME A8004T router firmware version 14.18.2, specifically in the VPN Service's commit_vpncli_file_upload function within the /cgi/timepro.cgi file. It allows attackers to bypass authentication and upload arbitrary OpenVPN configuration files (.ovpn) without proper validation. These malicious files can contain commands that execute with root privileges when processed by the VPN service, leading to full system compromise. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to a full system compromise of the affected router. Attackers can remotely upload malicious files that execute arbitrary commands with root privileges, impacting the confidentiality, integrity, and availability of the device. This could allow unauthorized control over the router and potentially the network it manages. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on identifying unauthorized access attempts to the /cgi/timepro.cgi endpoint, especially the commit_vpncli_file_upload function. Monitoring HTTP requests for access to /cgi/timepro.cgi instead of the intended /sess-bin/ path may indicate exploitation attempts. Additionally, scanning the system for unexpected .ovpn files in /etc/econf/vpnclient/openvpn/ could reveal uploaded malicious configurations. Network IDS/IPS rules can be created to alert on such HTTP POST requests to /cgi/timepro.cgi. Specific commands might include: 1) Using curl or wget to test access to /cgi/timepro.cgi without authentication to verify exposure. 2) Using find command on the device to locate recently modified or new .ovpn files: `find /etc/econf/vpnclient/openvpn/ -name '*.ovpn' -mtime -7` to find files modified in the last 7 days. 3) Monitoring web server logs for suspicious POST requests to /cgi/timepro.cgi. However, no explicit detection commands are provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Restricting access to the /cgi/timepro.cgi endpoint to trusted users only, possibly via firewall rules or access control lists. 2) Monitoring and removing any unauthorized .ovpn files in /etc/econf/vpnclient/openvpn/. 3) Considering replacing the affected EFM ipTIME A8004T router firmware version 14.18.2 with an alternative solution, as no vendor patches or countermeasures have been provided. 4) Disabling the VPN service if possible until a secure fix or replacement is implemented. Since the vendor has not responded and no patches are available, these steps are critical to reduce risk. [2]