What’s Vulnerable › Vulnerabilities

CVE-2026-90847: EFM ipTIME C200E System Setup iux_set.cgi os command injection

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-15
• Weakness: CWE-77

Description

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Affected products

• EFM ipTIME C200E: 1.094

References

• https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link
• https://vuldb.com/cve/CVE-2026-90847
• https://vuldb.com/submit/925831
• https://vuldb.com/vuln/403400
• https://vuldb.com/vuln/403400/cti
• https://youtu.be/qdFGRSpCiY0

Get alerted when CVE-2026-90847 or the next vulnerability affects your stack