CVE-2026-2550: EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commitvpnclifileupload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2550?
CVE-2026-2550 has a high severity due to the potential for unrestricted file uploads which can lead to remote code execution.
How do I fix CVE-2026-2550?
To fix CVE-2026-2550, update your EFM iptime A6004MX device to the latest firmware version that addresses this vulnerability.
What type of vulnerability is CVE-2026-2550?
CVE-2026-2550 is classified as an unrestricted file upload vulnerability.
Can CVE-2026-2550 be exploited remotely?
Yes, CVE-2026-2550 can be exploited remotely by an attacker without requiring authentication.
What products are affected by CVE-2026-2550?
CVE-2026-2550 affects the EFM iptime A6004MX router running version 14.18.2.