Impact

Successful exploitation of CVE-2026-90847 grants an attacker remote code execution capabilities on the affected ipTIME C200E devices. This can lead to a total loss of confidentiality, integrity, and availability of the device, potentially facilitating lateral movement into the local network where the device is deployed. As the vulnerability is remotely exploitable without authentication, any internet-exposed device is at high risk of automated exploitation by threat actors scanning for vulnerable networking equipment.

Recommendation

Identify and inventory all EFM ipTIME C200E devices deployed within the environment. If possible, restrict administrative access and the iux_set.cgi interface to trusted internal management subnets. Monitor web server logs for HTTP requests directed at iux_set.cgi containing shell metacharacters such as semicolon, pipe, or backticks that suggest command injection attempts. Contact the vendor for firmware updates addressing CVE-2026-90847.