Vulnerability · Published Aug 10, 2026 · Assigned by VulDB

CVE-2026-19379EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection

High 7.3

In plain English

A high-severity OS command injection in ipTIME AX8004M from EFM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)2.0%top 18.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
EFM	ipTIME AX8004M	15.09.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-387272 | EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection vdb-entry, technical-description
VDB-387272 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19379 | CVE Analysis and Report third-party-advisory
Submit #866635 | IPtime ipTIME AX8004M AX8004M 15.09.0 Arbitrary File Read third-party-advisory
https://github.com/seting-and-break/vulnerability-reports/blob/main/ipTIME_AX8004M_Vulnerability_Report.md exploit