CVE-2025-55423
CriticalSummary
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
Risk Assessment
An attacker can execute arbitrary system commands on the router, potentially leading to device takeover, network compromise, and potential access to data transmitted over the network.
Recommendation
Update ipTIME router firmware to the latest version containing a fix.
Original NVD description (English source)
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.