CVE-2026-2550
EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload
- State
- Published
- Severity
- 9.3 Critical
- Published
- Feb 16, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 15, 2026
Description
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R | VulDB |
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R | VulDB |
| 2.0 | 10.0 High | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
iptime A6004MXEFM |
|
References
- VDB-346159 | EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted uploadvdb-entrytechnical-description
- VDB-346159 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #749986 | EFM iptime A6004MX 14.18.2 Authentication Bypass & Arbitrary File Upload leading to RCEthird-party-advisory
- https://github.com/LX-LX88/cve-new/issues/3exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.