Iptime vulnerabilities
We track 6 vulnerabilities in Iptime products across 60+ products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.
Latest Iptime vulnerabilities
- 7.5 High severity
ipTIME T5008: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc. IpTIME T5008, EFM-Networks, Inc. IpTIME AX2004M, EFM-Networks, Inc. IpTIME AX3000Q, EFM-Networks, Inc. IpTIME AX6000M allows Authentication Bypass.This issue affects
- 7.2 High severity
ipTIME A8004T: Unrestricted Upload of File with Dangerous Type
A vulnerability was identified in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi of the component VPN Service. Such manipulation leads to unrestricted upload. It is possible to l
- 9.8 Critical severity
ipTIME A8004T: Improper Authentication
A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be
- 9.8 Critical severity
N104s-r1 Firmware: Improper Control of Generation of Code
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, all
- 8.8 High severity
NAS1dual, NAS2dual, NAS4dual: Cross-Site Request Forgery
This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete u
- 8.8 High severity
NAS1dual, NAS2dual, NAS4dual: Cross-Site Request Forgery
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.