CVE-2026-90847: EFM ipTIME C200E System Setup iux_set.cgi os command injection
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iuxset.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Which systems are known to be affected?
The identified affected system is EFM ipTIME C200E version 1.094, specifically the System Setup component's iux_set.cgi file. No other versions or products are identified in the available data.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the supplied CVSS vector indicates that high privileges are required. User interaction is not required.
Is exploitation likely to be practical?
Public exploit disclosure is reported, and the vulnerability is rated critical with potential impact to confidentiality, integrity, and availability. The provided exploit maturity rating is proof-of-concept.