CVE-2026-90847

Name of the Vulnerable Software and Affected Versions EFM ipTIME C200E version 1.094

Description An OS command injection flaw exists in the System Setup component of the device. The issue is located within an unknown function of the iux set.cgi endpoint. This flaw allows a remote attacker to inject and execute arbitrary operating system commands without authentication by manipulating input supplied to the endpoint. OS command injection is a vulnerability where an application improperly validates input, allowing an attacker to execute system-level commands on the host operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable internet-facing management. Restrict the management interface to trusted networks. Monitor for unexplained configuration changes and unusual outbound traffic.