Remote Command Injection in EFM ipTIME AX8004M

The EFM ipTIME AX8004M router (firmware version 15.09.0) contains a critical remote command injection vulnerability, tracked as CVE-2026-19379. The flaw originates in the handling of the 'fname' argument within the 'popen' function of the '/cgi/d.cgi' component. Because this endpoint fails to properly sanitize user-supplied input before passing it to the underlying system shell, an unauthenticated remote attacker can inject and execute arbitrary commands with the privileges of the web server process. This vulnerability is significant due to the device's role as a network gateway, potentially providing attackers with a foothold to intercept traffic, perform lateral movement, or conduct further exploitation within the internal network. Disclosure of this vulnerability has occurred publicly without a corresponding vendor patch, leaving deployed devices exposed to potential exploitation attempts.

Attack Chain

1. Attacker performs reconnaissance to identify ipTIME AX8004M devices reachable via the internet.
2. Attacker probes the target for the presence of the vulnerable '/cgi/d.cgi' endpoint.
3. Attacker constructs an HTTP GET or POST request targeting the 'fname' parameter.
4. Attacker inserts shell metacharacters (e.g., semicolon, pipe, backticks) into the 'fname' argument string.
5. The web server process passes the unsanitized 'fname' string to the 'popen' function.
6. The underlying system shell interprets the injected metacharacters and executes the attacker's payload.
7. Attacker gains remote command execution on the router, establishing persistence or exfiltrating data.

Impact

Successful exploitation allows for full remote compromise of the ipTIME AX8004M router. Impacted organizations and residential users face the risk of total device takeover, which can facilitate man-in-the-middle attacks, credential theft, or the use of the router as a node in a botnet. As of the current disclosure, no vendor-provided patch exists, making immediate network-level isolation or firewalling of management interfaces the only viable mitigation.

Recommendation

• Monitor ingress traffic to internal networks for HTTP requests directed toward the '/cgi/d.cgi' URI stem.
• Implement strict firewall rules to prevent remote access to router management interfaces from untrusted or public IP addresses.
• Audit logs for suspicious command execution patterns originating from web service processes on network appliances.