Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
CVE-2026-90847: ipTIME C200E OS Injection
Critical CVSS (9.1) reachable over network.
TL;DR - Remote OS command injection in ipTIME C200E 1.094 (CVSS 9.1). - Internet-facing devices exposed, no patch released. - Restrict management interface and monitor for vendor fix.
1. Vulnerability at a Glance
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-90847 |
| CVSS Score | 9.1 (Critical) |
| Attack Vector | Remote (network) |
| Privileges Required | None (unauthenticated) |
| Patch Status | No documented patch; vendor has not released a fixed version |
2. What Is This Vulnerability?
CVE-2026-90847 resides in the iux_set.cgi script within the System Setup functionality of EFM ipTIME C200E firmware version 1.094. The affected function processes user-supplied input without adequate sanitization, allowing an unauthenticated attacker to inject arbitrary operating system commands via specially crafted HTTP requests. Because the component is exposed over the network and lacks input validation, command injection can lead to full system compromise, including execution of arbitrary code with the privileges of the web server process.
While the NVD summary does not disclose the exact function or the specific payload format, the described vector is consistent with classic CGI command-injection flaws, where metacharacters such as ;, |, `, and & are not neutralized before being passed to a shell. Defenders should treat any unauthenticated request to iux_set.cgi as potentially malicious until the vendor releases a patched firmware.
3. Who Is Affected?
Product: EFM ipTIME C200E. Version: 1.094 (affected). The NVD record specifies that no earlier or later versions are documented as affected; however, the absence of version-range data means that other firmware releases may also be vulnerable, or the flaw may have been resolved in a later, undocumented build. Until EFM/ipTIME publishes an official advisory with precise version boundaries, defenders should assume that ipTIME C200E running firmware 1.094 is vulnerable. If the device is running any other version, the risk profile should be assessed by consulting the vendor’s release notes or performing a firmware version check via the device’s admin interface.
4. CVSS Score Breakdown
The CVSS v3.1 base score of 9.1 reflects the severity of an unauthenticated, remotely exploitable code-execution flaw. Breaking down the vector components (as inferred from the NVD description and typical OS-command-injection patterns):
- Attack Vector (AV): Network (N) – the vulnerability is exploitable over the network without requiring physical access or local system interaction.
- Attack Complexity (AC): Low (L) – the attack does not require specialized conditions or complex exploitation techniques; a crafted HTTP request suffices.
- Privileges Required (PR): None (N) – the attacker does not need an account or elevated privileges on the target device.
- User Interaction (UI): None (N) – exploitation does not depend on user action such as clicking a link.
- Scope (S): Changed (C) – the vulnerable component’s security scope extends beyond its own boundary, affecting other resources on the system.
- Confidentiality (C): High (H) – successful exploitation can lead to unauthorized disclosure of sensitive data.
- Integrity (I): High (H) – the attacker can modify system files or configurations.
- Availability (A): High (H) – commands executed may include destructive operations such as service disruption or malware deployment.
Combining these as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a base score of 9.1 Critical. The NVD does not publish an explicit vector string, but the score aligns with the described remote, unauthenticated command-injection capability. Because the scope is changed (S:C), the impact extends beyond the CGI process, affecting other resources on the system. This justifies the CVSS 9.1 rating, as the flaw can lead to full system compromise from a network-level, unauthenticated position.
The scope (S:C) component reflects how the vulnerability crosses traditional access control boundaries; for further context on modern access models, see our ABAC glossary: ABAC glossary.
5. Exploitation Status
As of this research, the CISA Known Exploited Vulnerabilities (KEV) catalog does not list CVE-2026-90847, indicating that no confirmed active exploitation in the wild has been reported to KEV as of the catalog check. However, the NVD notes that “the exploit has been publicly disclosed and may be utilized,” and the research note confirms public disclosure. A public proof-of-concept or exploit code may be circulating on security forums or GitHub repositories, though its prevalence and active use cannot be verified from the available sources. Defenders should treat the vulnerability as potentially active in exploitation despite the absence from KEV, especially given the high CVSS score and public disclosure. EPSS percentile data is not publicly available for this CVE; defenders should base risk assessment on the CVSS 9.1 score and the public exploit disclosure, treating the vulnerability as high priority.
For a comparable firmware vulnerability analysis, our coverage of CVE-2026-45695 provides additional insights: CVE-2026-45695.
6. How to Detect It
Detection requires monitoring for anomalous traffic targeting the iux_set.cgi endpoint and analyzing logs for command-injection indicators. The following concrete log pattern can be used in web server access logs (e.g., Apache or Nginx) to flag potential exploitation attempts:
> POST /iux_set.cgi HTTP/1.1" 200 \d{3}.*(;|\\|\$\{|\x60|&)
This pattern matches POST requests to the vulnerable script where shell metacharacters appear in the request body or query parameters. In a Splunk environment, a detection query could be:
index=web sourcetype=access_combined method=POST uri="/iux_set.cgi" | regex "\\||\\${`\s"
Additionally, network-based IDS signatures such as a Suricata rule can be deployed:
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"CVE-2026-90847 potential iux_set.cgi command injection";
content: "POST"; http_method;
uri: "/iux_set.cgi";
content: ";"; distance 0; flow:established,from_client;
content: "|2f|"; distance 0;)
While these signatures are illustrative and may require tuning to reduce false positives, they provide a starting point for detecting exploitation attempts in environments running the affected firmware.
7. Mitigation and Patching
No official patch or fixed firmware version is documented for ipTIME C200E 1.094 at the time of this research, and the vendor (EFM/ipTIME) has not released a corrected build through public advisories. The Google Drive reference (https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link) hosts a firmware archive (applyrestore.zip), but its contents could not be fully parsed to confirm the presence of a fix. Defenders should therefore adopt the following workarounds until a verified patch is published:
-
Restrict remote management access: Log into the ipTIME C200E web admin interface and disable remote access to the System Setup page. Limit the management interface to LAN-only connectivity by configuring the router to accept admin connections only from internal IP addresses. This effectively removes the internet-facing attack surface for
iux_set.cgi. -
Block inbound TCP ports 80 and 443 at the perimeter firewall or NAT gateway if the web management interface is not required for external administration. This prevents unauthenticated remote requests from reaching the device.
-
Monitor the vendor advisory page regularly. When EFM/ipTIME publishes a patched firmware, the typical upgrade procedure for ipTIME C200E involves downloading the
.binfirmware file from the official support site and applying it via the web interface’s “Firmware Upgrade” tool or through the command-line TFTP method:tftp <device-ip> get <filename>.bin(Note: exact TFTP commands vary by model; consult the device manual for the correct syntax.) -
As a last resort, consider replacing the device if the vendor does not release a patch within a reasonable timeframe, given the critical severity and the public exploit disclosure.
Technical Notes: Workarounds and Upgrade Commands
The lack of a documented fix means that immediate mitigation relies on network segmentation and access control. If a firmware update becomes available, administrators should follow the vendor’s published flash procedure, which typically involves backing up the current configuration, downloading the latest .bin file from the EFM/ipTIME support portal, and initiating the upgrade via the device’s web interface or a TFTP server. Until then, the workarounds above should be implemented in priority order: first restrict remote management, then block inbound management traffic, and finally maintain vigilant monitoring for vendor advisories.
For organizations evaluating secure remote access alternatives during incident response, Check NordVPN pricing → can provide encrypted tunneling, though the primary recommendation remains LAN-only management. Complementing network monitoring with endpoint protection such as Get Bitdefender → helps detect any malicious artifacts from attempted exploitation. In research environments, Check NordVPN pricing → offers secure, encrypted connections for safe vulnerability analysis. To uphold the principle of least privilege in your own infrastructure, securing administrative accounts with a reputable password manager is recommended; Try 1Password → offers a secure solution for credential storage.
8. References
- NVD Record: https://nvd.nist.gov/vuln/detail/CVE-2026-90847 – Primary source for CVSS scoring, description, and initial references.
- Google Drive Firmware Archive: https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link – Contains applyrestore.zip; referenced in NVD but contents could not be fully parsed during this research.
- vuldb CVE Entry: https://vuldb.com/cve/CVE-2026-90847 – Referenced in NVD; access blocked via HTTP 403 during this research.
- vuldb Submit/CTI Pages: https://vuldb.com/submit/925831, https://vuldb.com/vuln/403400, https://vuldb.com/vuln/403400/cti – CTI data sources referenced in the NVD record; access restrictions prevented retrieval.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.