CVEvulnerability

CVE-2025-55423

9.8 CRITICAL Published 2026-01-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.

Affected configurations

• iptime n104s-r1 firmware (>= 9.90.8 <= 10.02.2) • iptime n104v firmware (>= 9.90.8 <= 10.06.8) • iptime n1e firmware (>= 9.90.8 <= 10.06.8) • iptime n1plus firmware (>= 9.90.8 <= 10.06.8) • iptime n1plus-i firmware (>= 9.99.6 <= 10.06.8) • iptime n1v firmware (>= 11.01.2 <= 12.07.6) • iptime n2e firmware (>= 9.90.8 <= 10.06.8) • iptime n2eplus firmware (>= 9.90.8 <= 10.06.8) • iptime n2plus firmware (>= 9.90.8 <= 10.06.8) • iptime n2plus-i firmware (>= 9.99.6 <= 10.06.8) • iptime n2v firmware (>= 10.09.2 <= 12.16.8) • iptime n2vs firmware 12.16.8 • iptime n3 firmware (>= 9.93.2 <= 10.06.8) • iptime n3-i firmware (>= 9.99.6 <= 10.06.8) • iptime n5 firmware (>= 9.90.8 <= 10.06.8) • iptime n5-i firmware (>= 9.99.6 <= 10.06.8) • iptime n6 firmware (>= 9.96.8 <= 10.06.8) • iptime n600 firmware (>= 10.00.8 <= 12.16.2) • iptime n6004r firmware (>= 9.90.8 <= 10.02.2) • iptime n602e firmware (>= 11.96.6 <= 12.16.8) • iptime n602eplus firmware (>= 12.14.2 <= 12.16.2) • iptime n602se firmware (>= 14.19.0 <= 14.19.4) • iptime n604 black firmware (>= 9.93.8 <= 12.16.2) • iptime n604a firmware (>= 9.90.8 <= 10.06.8) • iptime n604e firmware (>= 10.09.2 <= 14.19.4) • iptime n604eplus firmware (>= 12.14.2 <= 14.19.4) • iptime n604plus firmware (>= 9.90.8 <= 12.15.2) • iptime n604plus-i firmware (>= 9.99.6 <= 12.14.6) • iptime n604r firmware (>= 9.90.8 <= 10.06.8) • iptime n604rplus firmware (>= 9.90.8 <= 10.06.8) • iptime n604rplus-i firmware (>= 9.99.6 <= 10.06.8) • iptime n604s firmware (>= 9.90.8 <= 10.06.8) • iptime n604se firmware (>= 14.18.4 <= 14.19.4) • iptime n604t firmware (>= 9.90.8 <= 10.03.2) • iptime n604tplus firmware (>= 9.90.8 <= 10.03.2) • iptime n604v firmware (>= 9.90.8 <= 10.06.8) • iptime n604vplus firmware (>= 9.90.8 <= 10.06.8) • iptime n7004ns firmware 9.91.2 • iptime n702bcm firmware (>= 9.90.8 <= 12.16.2) • iptime n702e firmware (>= 10.09.2 <= 12.16.2) • iptime ax11000 firmware (>= 14.16.6 <= 14.19.4) • iptime ax2002mesh firmware (>= 14.16.6 <= 14.19.4) • iptime ax2004 firmware (>= 14.17.4 <= 14.19.4) • iptime ax2004bcm firmware (>= 12.04.2 <= 14.19.4) • iptime ax2004m firmware (>= 14.02.0 <= 14.19.4) • iptime ax3004bcm firmware (>= 14.16.2 <= 14.19.4) • iptime ax3004itl firmware (>= 12.01.2 <= 14.19.4) • iptime ax8004bcm firmware (>= 11.97.2 <= 14.19.4) • iptime ax8004m firmware (>= 14.05.2 <= 14.19.4) • iptime ax8008m firmware (>= 14.15.4 <= 14.19.4) • iptime a1 firmware (>= 9.96.8 <= 10.07.4) • iptime a1004 firmware (>= 9.90.8 <= 12.16.2) • iptime a1004ns firmware (>= 9.96.0 <= 12.16.2) • iptime a1004v firmware (>= 9.90.8 <= 12.16.2) • iptime a104 firmware (>= 9.90.8 <= 10.03.8) • iptime a104ns firmware (>= 9.96.0 <= 12.16.2) • iptime a104r firmware (>= 9.90.8 <= 10.07.4) • iptime a104r firmware • iptime a2003mu firmware (>= 12.13.0 <= 12.16.2) • iptime a2003ns-mu firmware (>= 10.00.6 <= 12.16.2) … and 104 more

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References