EFM — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/efm/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 05 May 2026 14:16:09 +0000EFM ipTIME NAS1dual Stack-Based Buffer Overflow Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-iptime-nas1dual-overflow/Tue, 05 May 2026 14:16:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-iptime-nas1dual-overflow/A stack-based buffer overflow vulnerability exists in EFM ipTIME NAS1dual 1.5.24, affecting the get_csrf_whites function in /cgi/advanced/misc_main.cgi, exploitable remotely, and leading to potential arbitrary code execution.A stack-based buffer overflow vulnerability has been identified in EFM ipTIME NAS1dual version 1.5.24. The vulnerability resides within the get_csrf_whites function of the /cgi/advanced/misc_main.cgi file. Successful exploitation of this vulnerability allows a remote attacker to potentially execute arbitrary code on the affected device. Public exploits targeting this flaw are available, increasing the risk of widespread exploitation. The vendor, EFM, has been notified about the vulnerability but has not provided a response or patch as of this writing. This lack of responsiveness exacerbates the threat posed by this vulnerability, making it critical for users to implement mitigating measures.

Attack Chain

  1. The attacker identifies a vulnerable EFM ipTIME NAS1dual device running firmware version 1.5.24.
  2. The attacker crafts a malicious HTTP request targeting the /cgi/advanced/misc_main.cgi endpoint.
  3. The crafted request includes an overly long string that overflows the buffer allocated for the get_csrf_whites function.
  4. The overflow overwrites adjacent memory regions on the stack, including the return address.
  5. The attacker sets the overwritten return address to point to attacker-controlled code.
  6. The vulnerable get_csrf_whites function returns, transferring control to the attacker-specified address.
  7. The attacker-controlled code executes with the privileges of the web server process.
  8. The attacker gains arbitrary code execution on the NAS device, enabling them to install malware, steal data, or pivot to other network resources.

Impact

Successful exploitation of this vulnerability grants an attacker complete control over the affected EFM ipTIME NAS1dual device. This could lead to sensitive data stored on the NAS being compromised, the device being used as a bot in a botnet, or the device being held for ransom. Given the high CVSS score of 9.8, the impact is considered critical. Since public exploits are available, mass exploitation is a significant risk for unpatched devices.

Recommendation

  • Monitor web server logs for suspicious requests to /cgi/advanced/misc_main.cgi containing abnormally long strings (see Sigma rule Detect Suspicious URI Length).
  • Implement rate limiting on requests to /cgi/advanced/misc_main.cgi to mitigate potential brute-force exploitation attempts (see Sigma rule Detect High Volume Requests to Vulnerable Endpoint).
  • Consider deploying a web application firewall (WAF) rule to block requests with overly long inputs to the get_csrf_whites function.
]]>criticaladvisorystack-based-buffer-overflowcve-2026-7834iptimenaswebserverEFM ipTIME C200 Command Injection Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-iptime-c200-cmd-injection/Tue, 05 May 2026 13:16:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-iptime-c200-cmd-injection/EFM ipTIME C200 devices are vulnerable to remote command injection due to insufficient validation of the RestoreFile argument in the /cgi/iux_set.cgi endpoint, allowing attackers to execute arbitrary commands with elevated privileges.A critical command injection vulnerability, CVE-2026-7833, affects EFM ipTIME C200 devices up to version 1.092. The vulnerability resides within the sub_408F90 function of the /cgi/iux_set.cgi file, specifically the ApplyRestore Endpoint. By manipulating the RestoreFile argument, an attacker can inject arbitrary commands that will be executed on the device. The vulnerability can be exploited remotely and proof-of-concept exploit code is publicly available. The vendor was notified but did not respond, increasing the risk to users of these devices. This vulnerability allows for complete system compromise of affected devices.

Attack Chain

  1. The attacker sends a crafted HTTP POST request to /cgi/iux_set.cgi.
  2. The request includes the RestoreFile argument containing a command injection payload within the ApplyRestore endpoint.
  3. The sub_408F90 function processes the RestoreFile argument without proper sanitization.
  4. The injected command is executed with the privileges of the webserver process.
  5. The attacker gains arbitrary code execution on the device.
  6. The attacker pivots to internal network if the device acts as a gateway.
  7. The attacker may install persistent backdoors or malware.
  8. The attacker could exfiltrate sensitive information or disrupt device operations.

Impact

Successful exploitation of CVE-2026-7833 allows a remote attacker to execute arbitrary commands on the EFM ipTIME C200 device. This could lead to complete compromise of the device, including unauthorized access to the device’s configuration, data, and network. Given the device’s role as a network gateway, successful exploitation could also allow the attacker to pivot to other devices on the internal network. The lack of vendor response exacerbates the risk.

Recommendation

  • Apply network access control lists to restrict access to the /cgi/iux_set.cgi endpoint from untrusted networks.
  • Monitor web server logs for suspicious POST requests targeting the /cgi/iux_set.cgi endpoint with unusual RestoreFile arguments. Deploy the Sigma rule to detect command injection attempts.
  • Utilize vulnerability scanning tools to identify potentially vulnerable EFM ipTIME C200 devices on the network.
]]>criticalthreatcommand injectioniotcve-2026-7833