CVE-2025-55423
PoC —CVSS 3.1
9.8 critical
EPSS
3%p88
Published
()
Modified
Description
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
- Vendors
- iptime
- Products
- n104s-r1 firmware, n104v firmware, n1e firmware, n1plus firmware, n1plus-i firmware, n1v firmware, n2e firmware, n2eplus firmware, n2plus firmware, n2plus-i firmware, n2v firmware, n2vs firmware
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.