CVE-2026-1741

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1741", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-01T08:06:21.873Z", "datePublished": "2026-02-02T03:02:06.833Z", "dateUpdated": "2026-02-23T09:13:22.116Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:13:22.116Z"}, "title": "EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-912", "lang": "en", "description": "Backdoor"}]}], "affected": [{"vendor": "EFM", "product": "ipTIME A8004T", "versions": [{"version": "14.18.2", "status": "affected"}], "modules": ["Debug Interface"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.5, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.6, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.8, "vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-02T05:27:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "LX-LX (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343640", "name": "VDB-343640 | EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343640", "name": "VDB-343640 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741423", "name": "Submit #741423 | EFM IPTIME A8004T 14.18.2 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LX-LX88/cve/issues/28", "tags": ["broken-link", "exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T14:13:44.417609Z", "id": "CVE-2026-1741", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T14:14:04.340Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1741", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-02T14:13:44.417609Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T14:13:59.762Z"}}], "cna": {"title": "EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor", "credits": [{"lang": "en", "type": "reporter", "value": "LX-LX (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.8, "vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "EFM", "modules": ["Debug Interface"], "product": "ipTIME A8004T", "versions": [{"status": "affected", "version": "14.18.2"}]}], "timeline": [{"lang": "en", "time": "2026-02-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-02T05:27:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343640", "name": "VDB-343640 | EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343640", "name": "VDB-343640 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.741423", "name": "Submit #741423 | EFM IPTIME A8004T 14.18.2 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LX-LX88/cve/issues/28", "tags": ["broken-link", "exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-912", "description": "Backdoor"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:13:22.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1741", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:13:22.116Z", "dateReserved": "2026-02-01T08:06:21.873Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-02T03:02:06.833Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Debug Interface"], "product": "ipTIME A8004T", "vendor": "EFM", "versions": [{"status": "affected", "version": "14.18.2"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:iptime:a8004t_firmware:14.18.2:*:*:*:*:*:*:*", "matchCriteriaId": "C875D1A0-3D66-4DAB-BD93-3ADECE43F457", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:iptime:a8004t:-:*:*:*:*:*:*:*", "matchCriteriaId": "842D759D-9279-4ED9-B4DA-86493E25DE17", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en EFM ipTIME A8004T 14.18.2. Se ve afectada la funci\u00f3n httpcon_check_session_url del archivo /sess-bin/d.cgi del componente Debug Interface. Esta manipulaci\u00f3n del argumento cmd provoca una puerta trasera. Es posible iniciar el ataque remotamente. La complejidad de un ataque es bastante alta. Se dice que la explotabilidad es dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1741", "lastModified": "2026-06-17T10:16:26.097", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:H/Au:M/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1741", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T14:13:44.417609Z", "version": "2.0.3"}}]}, "published": "2026-02-02T04:15:55.170", "references": [{"source": "cna@vuldb.com", "tags": ["Broken Link", "Issue Tracking"], "url": "https://github.com/LX-LX88/cve/issues/28"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.343640"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.343640"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.741423"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-912"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:47:43.150410+00:00", "value": {"mitigation_remediation": ["Update the router firmware to the latest version that includes a fix for the backdoor.", "Disable or remove the Debug Interface feature if it is not required for normal operation.", "Restrict network access to the /sess-bin/d.cgi endpoint using firewall or ACL rules to prevent unauthorized remote connections."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Backdoor"}, "threat_synthesis": {"affected_systems": "Affected vendors and products: EFM ipTIME A8004T router running firmware version 14.18.2. The product is the Debug Interface component, specifically the /sess-bin/d.cgi file. Currently identified only in ipTIME A8004T firmware 14.18.2.", "description_and_impact": "The vulnerability lies in the httpcon_check_session_url function within the Debug Interface of EFM ipTIME A8004T firmware 14.18.2. By manipulating the \"cmd\" argument in the /sess-bin/d.cgi endpoint, an attacker can trigger a backdoor that yields remote code execution capabilities. The flaw is categorized as CWE\u2011912. Remote exploitation would allow an attacker to run arbitrary commands, compromising the device.", "risk_and_exploitability": "The CVSS base score is 7.5, indicating a high severity. EPSS indicates the probability of exploitation is less than 1%, implying low overall risk compared to other vulnerabilities. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires manipulating a query parameter from a remote connection and is considered difficult. Nevertheless, if successful, it can lead to full device compromise. The attack vector is remote through the debugging interface."}}}}, "created": "2026-02-02T09:26:08.975079+00:00", "updated": "2026-04-18T01:00:11.619298+00:00", "vendors": ["iptime", "iptime$PRODUCT$a8004t"]}