by Kastro
Paper/Archive/CVE-2026-90847

CVE-2026-90847

EFM ipTIME C200E — EFM ipTIME C200E System Setup iux_set.cgi os command injection

EPSS 3%public exploitCVSS 9.4
critical.is priorityof 100
56
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 88.8.888 × 2017.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected

ProductAffectedFixed inSource
ipTIME C200E1.094–CNA

Scores by source

VulDB (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
VulDB (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refvuldb.com/vuln/403400refvuldb.com/vuln/403400/ctiwriteupvuldb.com/cve/CVE-2026-90847writeupvuldb.com/submit/925831refdrive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_linkexploityoutu.be/qdFGRSpCiY0