EFM vulnerabilities
We track 11 vulnerabilities in EFM products across 9 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest EFM vulnerabilities
- 9.1 Critical severity
ipTIME C200E: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The expl
- 9.8 Critical severity
ipTIME T24000M: Improper Authentication
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remo
- 10.0 Critical severity
ipTIME T16000M: Improper Authentication
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is pos
- 10.0 Critical severity
ipTIME A3004T: Improper Authentication
A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is po
- 7.3 High severity
ipTIME AX8004M: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The ex
- 8.8 High severity
ipTIME A8004T: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security_5g leads to stack-based buffer overflow. The attack ma
- 9.8 Critical severity
ipTIME NAS1dual: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/advanced/misc_main.cgi. Such manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The
- 7.2 High severity
ipTIME C200: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component ApplyRestore Endpoint. This manipulation of the argument RestoreFile causes command injection. The a
- 9.8 Critical severity
iptime A6004MX: Improper Access Control
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public
- 7.2 High severity
ipTIME A8004T: Unrestricted Upload of File with Dangerous Type
A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi of the component VPN Service. Such manipulation leads to unrestricted upload. It is possible to l
- 9.8 Critical severity
ipTIME A8004T: Improper Authentication
A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be