CVE-2026-19379
Received Received - Intake

Command Injection in ipTIME AX8004M Router

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulDB

Description
A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19379
EUVD
EUVD-2026-54974

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
efm iptime_ax8004m 15.09.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the EFM ipTIME AX8004M router firmware version 15.09.0. It exists in the /cgi/d.cgi endpoint where the fname parameter is passed to the popen function without proper sanitization. An attacker can send a crafted HTTP request to execute arbitrary operating system commands on the device.

Detection Guidance

To detect this vulnerability, check if your ipTIME AX8004M router is running firmware version 15.09.0. Test the /cgi/d.cgi endpoint by sending crafted HTTP GET requests with a fname parameter. Look for unauthorized file reads or command execution responses.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected router without authentication. They could read sensitive files like /etc/passwd or /etc/shadow, modify system configurations, install malware, or gain full control of the device. Since routers often handle all network traffic, compromise could lead to broader network intrusions.

Mitigation Strategies

Immediately update the router firmware to the latest version if available. If no update exists, restrict network access to the device's HTTP interface, disable remote administration, and monitor for suspicious activity. Consider replacing the device if the vendor does not provide a patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart