Vulnerability · Published Sep 15, 2026 · Assigned by VulDB

CVE-2026-90847EFM ipTIME C200E System Setup iux_set.cgi os command injection

Critical 9.1

In plain English

A critical-severity OS command injection in ipTIME C200E from EFM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)3.4%top 11.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
EFM	ipTIME C200E	1.094

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-403400 | EFM ipTIME C200E System Setup iux_set.cgi os command injection vdb-entry
VDB-403400 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90847 | CVE Analysis and Report third-party-advisory
Submit #925831 | EFM ipTIME C200E 1.094 Embedded Malicious Code third-party-advisory
https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link related
https://youtu.be/qdFGRSpCiY0 exploit, media-coverage