CVE-2025-55423: Command Injection
Published Jan 20, 2026
·Updated
A command injection vulnerability exists in the upnprelay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
Affected Software
327 affected components
All of the following
IPTIME N104s-r1 Firmware>=9.90.8<=10.02.2
IPTIME N104s-r1
All of the following
IPTIME N104v Firmware>=9.90.8<=10.06.8
IPTIME N104v
All of the following
IPTIME N1e Firmware>=9.90.8<=10.06.8
IPTIME N1e
All of the following
IPTIME N1plus Firmware>=9.90.8<=10.06.8
IPTIME N1plus
All of the following
IPTIME N1plus-i Firmware>=9.99.6<=10.06.8
IPTIME N1plus-i
All of the following
IPTIME N1v Firmware>=11.01.2<=12.07.6
IPTIME N1V
All of the following
IPTIME N2e Firmware>=9.90.8<=10.06.8
IPTIME N2e
All of the following
IPTIME N2eplus Firmware>=9.90.8<=10.06.8
IPTIME N2eplus
All of the following
IPTIME N2plus Firmware>=9.90.8<=10.06.8
IPTIME N2plus
All of the following
IPTIME N2plus-i Firmware>=9.99.6<=10.06.8
IPTIME N2plus-i
All of the following
IPTIME N2v Firmware>=10.09.2<=12.16.8
IPTIME N2V
All of the following
IPTIME N2vs Firmware=12.16.8
IPTIME N2vs
All of the following
IPTIME N3 Firmware>=9.93.2<=10.06.8
IPTIME N3
All of the following
IPTIME N3-i Firmware>=9.99.6<=10.06.8
IPTIME N3-i
All of the following
IPTIME N5 Firmware>=9.90.8<=10.06.8
IPTIME N5
All of the following
IPTIME N5-i Firmware>=9.99.6<=10.06.8
IPTIME N5-i
All of the following
IPTIME N6 Firmware>=9.96.8<=10.06.8
IPTIME N6
All of the following
IPTIME N600 Firmware>=10.00.8<=12.16.2
IPTIME N600
All of the following
IPTIME N6004r Firmware>=9.90.8<=10.02.2
IPTIME N6004r
All of the following
IPTIME N602e Firmware>=11.96.6<=12.16.8
IPTIME N602E
All of the following
IPTIME N602eplus Firmware>=12.14.2<=12.16.2
IPTIME N602eplus
All of the following
IPTIME N602se Firmware>=14.19.0<=14.19.4
IPTIME N602se
All of the following
IPTIME N604 Black Firmware>=9.93.8<=12.16.2
IPTIME N604 Black
All of the following
IPTIME N604a Firmware>=9.90.8<=10.06.8
IPTIME N604a
All of the following
IPTIME N604e Firmware>=10.09.2<=14.19.4
IPTIME N604E
All of the following
IPTIME N604eplus Firmware>=12.14.2<=14.19.4
IPTIME N604eplus
All of the following
IPTIME N604plus Firmware>=9.90.8<=12.15.2
IPTIME N604plus
All of the following
IPTIME N604plus-i Firmware>=9.99.6<=12.14.6
IPTIME N604plus-i
All of the following
IPTIME N604r Firmware>=9.90.8<=10.06.8
IPTIME N604r
All of the following
IPTIME N604rplus Firmware>=9.90.8<=10.06.8
IPTIME N604rplus
All of the following
IPTIME N604rplus-i Firmware>=9.99.6<=10.06.8
IPTIME N604rplus-i
All of the following
IPTIME N604s Firmware>=9.90.8<=10.06.8
IPTIME N604s
All of the following
IPTIME N604se Firmware>=14.18.4<=14.19.4
IPTIME N604se
All of the following
IPTIME N604t Firmware>=9.90.8<=10.03.2
IPTIME N604t
All of the following
IPTIME N604tplus Firmware>=9.90.8<=10.03.2
IPTIME N604tplus
All of the following
IPTIME N604v Firmware>=9.90.8<=10.06.8
IPTIME N604v
All of the following
IPTIME N604vplus Firmware>=9.90.8<=10.06.8
IPTIME N604vplus
All of the following
IPTIME N7004ns Firmware=9.91.2
IPTIME N7004ns
All of the following
IPTIME N702bcm Firmware>=9.90.8<=12.16.2
IPTIME N702bcm
All of the following
IPTIME N702e Firmware>=10.09.2<=12.16.2
IPTIME N702E
All of the following
IPTIME Ax11000 Firmware>=14.16.6<=14.19.4
IPTIME Ax11000
All of the following
IPTIME Ax2002mesh Firmware>=14.16.6<=14.19.4
IPTIME Ax2002mesh
All of the following
IPTIME Ax2004 Firmware>=14.17.4<=14.19.4
IPTIME Ax2004
All of the following
IPTIME Ax2004bcm Firmware>=12.04.2<=14.19.4
IPTIME Ax2004bcm
All of the following
IPTIME Ax2004m Firmware>=14.02.0<=14.19.4
IPTIME AX2004M
All of the following
IPTIME Ax3004bcm Firmware>=14.16.2<=14.19.4
IPTIME Ax3004bcm
All of the following
IPTIME Ax3004itl Firmware>=12.01.2<=14.19.4
IPTIME AX3004ITL
All of the following
IPTIME Ax8004bcm Firmware>=11.97.2<=14.19.4
IPTIME AX8004BCM
All of the following
IPTIME Ax8004m Firmware>=14.05.2<=14.19.4
IPTIME Ax8004m
All of the following
IPTIME Ax8008m Firmware>=14.15.4<=14.19.4
IPTIME Ax8008m
All of the following
IPTIME A1 Firmware>=9.96.8<=10.07.4
IPTIME A1
All of the following
IPTIME A1004 Firmware>=9.90.8<=12.16.2
IPTIME A1004
All of the following
IPTIME A1004ns Firmware>=9.96.0<=12.16.2
IPTIME A1004ns
All of the following
IPTIME A1004v Firmware>=9.90.8<=12.16.2
IPTIME A1004v
All of the following
IPTIME A104 Firmware>=9.90.8<=10.03.8
IPTIME A104
All of the following
IPTIME A104ns Firmware>=9.96.0<=12.16.2
IPTIME A104ns
All of the following
Any of the following
IPTIME A104r Firmware>=9.90.8<=10.07.4
IPTIME A104r Firmware
IPTIME A104r
All of the following
IPTIME A2003mu Firmware>=12.13.0<=12.16.2
IPTIME A2003mu
All of the following
IPTIME A2003ns-mu Firmware>=10.00.6<=12.16.2
IPTIME A2003NS-MU
All of the following
IPTIME A2004 Firmware>=9.90.8<=10.07.4
IPTIME A2004
All of the following
IPTIME A2004mu Firmware>=10.08.6<=12.17.0
IPTIME A2004MU
All of the following
IPTIME A2004ns Firmware>=9.90.8<=11.00.4
IPTIME A2004ns
All of the following
IPTIME A2004ns-mu Firmware>=10.08.6<=12.17.0
IPTIME A2004NS-MU
All of the following
IPTIME A2004ns-r Firmware>=9.90.8<=11.00.4
IPTIME A2004ns-r
All of the following
IPTIME A2004nsplus Firmware>=9.90.8<=11.00.4
IPTIME A2004nsplus
All of the following
IPTIME A2004plus Firmware>=9.90.8<=10.07.4
IPTIME A2004plus
All of the following
IPTIME A2004r Firmware>=9.90.8<=10.07.4
IPTIME A2004r
All of the following
IPTIME A2004se Firmware>=14.16.6<=14.19.4
IPTIME A2004se
All of the following
IPTIME A2008 Firmware>=9.90.8<=10.07.4
IPTIME A2008
All of the following
IPTIME A3 Firmware>=9.97.2<=10.07.2
IPTIME A3
All of the following
IPTIME A3002mesh Firmware>=12.05.4<=14.19.4
IPTIME A3002mesh
All of the following
IPTIME A3003ns Firmware>=9.99.8<=11.00.4
IPTIME A3003ns
All of the following
IPTIME A3004 Firmware>=9.90.8<=10.08.2
IPTIME A3004
All of the following
IPTIME A3004-dual Firmware>=9.90.4<=10.07.2
IPTIME A3004-dual
All of the following
IPTIME A3004m Firmware>=14.18.4<=14.19.4
IPTIME A3004m
All of the following
IPTIME A3004ns Firmware>=9.90.2<=10.09.4
IPTIME A3004ns
All of the following
IPTIME A3004ns-bcm Firmware>=9.95.8<=11.00.4
IPTIME A3004ns-bcm
All of the following
IPTIME A3004ns-dual Firmware>=9.90.4<=12.09.4
IPTIME A3004ns-dual
All of the following
IPTIME A3004ns-m Firmware>=10.05.4<=14.19.4
IPTIME A3004NS-M
All of the following
IPTIME A3004t Firmware>=12.10.2<=14.19.4
IPTIME A3004t
All of the following
IPTIME A3004tw Firmware>=14.15.2<=14.19.4
IPTIME A3004tw
All of the following
IPTIME A3008-mu Firmware>=10.08.4<=14.19.4
IPTIME A3008-MU
All of the following
IPTIME A304 Firmware>=10.05.4<=10.07.4
IPTIME A304
All of the following
IPTIME A5004ns Firmware>=9.90.2<=11.00.4
IPTIME A5004ns
All of the following
IPTIME A5004ns-m Firmware>=10.05.4<=14.19.4
IPTIME A5004NS-M
All of the following
IPTIME A6004mx Firmware>=12.04.6<=14.19.4
IPTIME A6004mx
All of the following
IPTIME A6004ns Firmware>=9.90.2<=11.00.4
IPTIME A6004ns
All of the following
IPTIME A6004ns-m Firmware>=9.99.8<=14.19.4
IPTIME A6004ns-m
All of the following
IPTIME A604 Firmware>=9.90.8<=12.06.6
IPTIME A604
All of the following
IPTIME A604-v3 Firmware>=10.01.6<=10.07.2
IPTIME A604-V3
All of the following
IPTIME A604-v5 Firmware>=10.09.2<=12.16.2
IPTIME A604-V5
All of the following
IPTIME A604g-mu Firmware>=10.07.4<=12.16.2
IPTIME A604G-MU
All of the following
IPTIME A604g-skylife Firmware>=12.02.4<=12.12.4
IPTIME A604G-skylife
All of the following
IPTIME A604m Firmware>=10.06.4<=10.07.2
IPTIME A604M
All of the following
IPTIME A604mu Firmware>=12.12.4<=12.16.2
IPTIME A604mu
All of the following
IPTIME A604r Firmware>=10.09.2<=12.16.2
IPTIME A604R
All of the following
IPTIME A604se Firmware>=14.17.2<=14.19.4
IPTIME A604se
All of the following
IPTIME A604v Firmware>=9.90.8<=10.07.4
IPTIME A604v
All of the following
IPTIME A6ns-m Firmware>=10.01.6<=14.19.4
IPTIME A6ns-M
All of the following
IPTIME A7004m Firmware>=10.06.8<=14.19.4
IPTIME A7004M
All of the following
IPTIME A704ns-bcm Firmware>=9.95.8<=11.00.4
IPTIME A704ns-bcm
All of the following
IPTIME A7ns Firmware>=9.96.0<=11.00.4
IPTIME A7ns
All of the following
IPTIME A8004bcm Firmware>=11.99.1<=12.16.2
IPTIME A8004BCM
All of the following
IPTIME A8004itl Firmware>=11.00.4<=14.19.4
IPTIME A8004ITL
All of the following
IPTIME A8004ns-m Firmware>=9.99.2<=14.19.4
IPTIME A8004ns-m
All of the following
IPTIME A8004t Firmware>=10.06.8<=14.19.4
IPTIME A8004T
All of the following
IPTIME A8004t-xr Firmware>=11.97.2<=14.19.4
IPTIME A8004T-XR
All of the following
IPTIME A804ns-mu Firmware>=10.06.4<=12.10.2
IPTIME A804NS-MU
All of the following
IPTIME A8ns-m Firmware>=10.03.2<=14.19.4
IPTIME A8ns-M
All of the following
IPTIME A9004m Firmware>=10.05.4<=14.19.4
IPTIME A9004M
All of the following
IPTIME A9004m-x2 Firmware>=11.98.2<=14.19.4
IPTIME A9004M-X2
All of the following
IPTIME Ew302n Firmware>=9.90.8<=12.16.2
IPTIME Ew302n
All of the following
IPTIME N102e Firmware>=11.00.8<=12.15.2
IPTIME N102E
All of the following
IPTIME N102eplus Firmware>=12.14.2<=12.15.2
IPTIME N102eplus
All of the following
IPTIME N102i Firmware>=11.01.2<=12.15.2
IPTIME N102i
All of the following
IPTIME N102iplus Firmware>=12.14.2<=12.15.2
IPTIME N102iplus
All of the following
IPTIME N104 Black Firmware>=9.93.8<=10.06.8
IPTIME N104 Black
All of the following
IPTIME N104e Firmware>=10.09.4<=12.15.2
IPTIME N104E
All of the following
IPTIME N104eplus Firmware>=12.14.2<=12.15.2
IPTIME N104eplus
All of the following
IPTIME N104k Firmware>=9.90.8<=10.06.8
IPTIME N104k
All of the following
IPTIME N104plus Firmware>=9.90.8<=10.06.8
IPTIME N104plus
All of the following
IPTIME N104plus-i Firmware>=9.99.6<=10.06.8
IPTIME N104plus-i
All of the following
IPTIME N104q Firmware>=9.90.8<=10.06.8
IPTIME N104q
All of the following
IPTIME N104q-i Firmware>=9.99.6<=10.06.8
IPTIME N104q-i
All of the following
IPTIME N104r Firmware>=9.90.8<=10.06.8
IPTIME N104r
All of the following
IPTIME N702eplus Firmware>=12.12.4<=12.16.2
IPTIME N702eplus
All of the following
IPTIME N702r Firmware>=10.05.8<=10.06.8
IPTIME N702R
All of the following
IPTIME N704-a3 Firmware>=9.90.8<=10.06.8
IPTIME N704-a3
All of the following
IPTIME N704bcm Firmware>=9.90.8<=12.16.2
IPTIME N704bcm
All of the following
IPTIME N704e Firmware>=11.98.4<=12.16.2
IPTIME N704E
All of the following
IPTIME N704eplus Firmware>=12.14.2<=12.16.2
IPTIME N704eplus
All of the following
IPTIME N704ns Firmware>=9.91.4<=9.96.0
IPTIME N704ns
All of the following
IPTIME N704qca Firmware>=10.02.4<=12.16.2
IPTIME N704QCA
All of the following
IPTIME N704v3 Firmware>=9.90.8<=12.10.2
IPTIME N704v3
All of the following
IPTIME N8004r Firmware>=9.90.8<=10.02.2
IPTIME N8004r
All of the following
IPTIME N8004v Firmware>=9.90.8<=10.02.2
IPTIME N8004v
All of the following
IPTIME N804 Firmware>=9.91.2<=9.96.8
IPTIME N804
All of the following
IPTIME N804a Firmware>=9.91.2<=9.96.8
IPTIME N804a
All of the following
IPTIME N804a3 Firmware>=9.90.8<=9.96.8
IPTIME N804a3
All of the following
IPTIME N804r Firmware>=10.06.4<=12.16.2
IPTIME N804R
All of the following
IPTIME N804t Firmware>=9.91.2<=9.96.8
IPTIME N804t
All of the following
IPTIME N804t3 Firmware>=9.90.8<=9.96.8
IPTIME N804t3
All of the following
IPTIME N804v Firmware>=9.91.2<=9.96.8
IPTIME N804v
All of the following
IPTIME N904 Firmware>=9.90.8<=10.02.2
IPTIME N904
All of the following
IPTIME N904ns Firmware>=9.91.4<=9.96.0
IPTIME N904ns
All of the following
IPTIME N904plus Firmware>=9.90.8<=10.02.2
IPTIME N904plus
All of the following
IPTIME N904v Firmware>=9.90.8<=10.02.2
IPTIME N904v
All of the following
IPTIME Smart Firmware>=9.90.8<=9.94.2
IPTIME Smart
All of the following
IPTIME Q1 Firmware=9.91.2
IPTIME Q1
All of the following
IPTIME Q304 Firmware=9.91.2
IPTIME Q304
All of the following
IPTIME Q504 Firmware=9.91.2
IPTIME Q504
All of the following
IPTIME Q604 Firmware=9.91.2
IPTIME Q604
All of the following
IPTIME T16000 Firmware>=9.91.2<=11.03.6
IPTIME T16000
All of the following
IPTIME T16000m Firmware>=12.07.4<=14.19.4
IPTIME T16000m
All of the following
IPTIME T24000 Firmware>=9.91.2<=11.03.6
IPTIME T24000
All of the following
IPTIME T24000m Firmware>=12.07.4<=14.19.4
IPTIME T24000m
All of the following
IPTIME T3004 Firmware>=9.90.8<=12.07.6
IPTIME T3004
All of the following
IPTIME T3008 Firmware>=9.90.8<=12.09.6
IPTIME T3008
All of the following
IPTIME T5004 Firmware>=11.96.4<=14.19.4
IPTIME T5004
All of the following
IPTIME T5008 Firmware>=11.98.2<=14.19.4
IPTIME T5008
All of the following
IPTIME V304 Firmware=9.91.2
IPTIME V304
All of the following
IPTIME V504 Firmware>=9.90.8<=12.15.2
IPTIME V504
All of the following
IPTIME V508 Firmware>=10.02.2<=10.06.4
IPTIME V508
Event History
Jan 20, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-55423?
CVE-2025-55423 has been classified as a critical severity vulnerability due to its potential for OS command injection in multiple ipTIME router models.
2
How do I fix CVE-2025-55423?
To fix CVE-2025-55423, users should update their affected ipTIME router firmware to the latest version provided by the vendor.
3
Which ipTIME router models are affected by CVE-2025-55423?
CVE-2025-55423 affects multiple ipTIME router models including A2003NS-MU, N600, A604-V3, A6ns-M, V508, and others within the specified version ranges.
4
What type of vulnerability is CVE-2025-55423?
CVE-2025-55423 is a command injection vulnerability that allows an attacker to execute arbitrary commands on the system via insufficient input validation.
5
What are the risks associated with CVE-2025-55423?
The risks associated with CVE-2025-55423 include unauthorized access to router functionalities and potential compromise of the entire network due to OS command execution.