CVE-2025-55423
EUVD-2026-337620.01.2026, 18:16
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| iptime | n104s-r1_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n104v_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n1e_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n1plus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n1plus-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n1v_firmware | 11.01.2 ≤ 𝑥 ≤ 12.07.6 |
| iptime | n2e_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n2eplus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n2plus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n2plus-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n2v_firmware | 10.09.2 ≤ 𝑥 ≤ 12.16.8 |
| iptime | n2vs_firmware | 12.16.8 |
| iptime | n3_firmware | 9.93.2 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n3-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n5_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n5-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n6_firmware | 9.96.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n600_firmware | 10.00.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n6004r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n602e_firmware | 11.96.6 ≤ 𝑥 ≤ 12.16.8 |
| iptime | n602eplus_firmware | 12.14.2 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n602se_firmware | 14.19.0 ≤ 𝑥 ≤ 14.19.4 |
| iptime | n604_black_firmware | 9.93.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n604a_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604e_firmware | 10.09.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | n604eplus_firmware | 12.14.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | n604plus_firmware | 9.90.8 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n604plus-i_firmware | 9.99.6 ≤ 𝑥 ≤ 12.14.6 |
| iptime | n604r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604rplus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604rplus-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604s_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604se_firmware | 14.18.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | n604t_firmware | 9.90.8 ≤ 𝑥 ≤ 10.03.2 |
| iptime | n604tplus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.03.2 |
| iptime | n604v_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n604vplus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n7004ns_firmware | 9.91.2 |
| iptime | n702bcm_firmware | 9.90.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n702e_firmware | 10.09.2 ≤ 𝑥 ≤ 12.16.2 |
| iptime | ax11000_firmware | 14.16.6 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax2002mesh_firmware | 14.16.6 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax2004_firmware | 14.17.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax2004bcm_firmware | 12.04.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax2004m_firmware | 14.02.0 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax3004bcm_firmware | 14.16.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax3004itl_firmware | 12.01.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax8004bcm_firmware | 11.97.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax8004m_firmware | 14.05.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ax8008m_firmware | 14.15.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a1_firmware | 9.96.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a1004_firmware | 9.90.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a1004ns_firmware | 9.96.0 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a1004v_firmware | 9.90.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a104_firmware | 9.90.8 ≤ 𝑥 ≤ 10.03.8 |
| iptime | a104ns_firmware | 9.96.0 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a104r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a104r_firmware | - |
| iptime | a2003mu_firmware | 12.13.0 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a2003ns-mu_firmware | 10.00.6 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a2004_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a2004mu_firmware | 10.08.6 ≤ 𝑥 ≤ 12.17.0 |
| iptime | a2004ns_firmware | 9.90.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a2004ns-mu_firmware | 10.08.6 ≤ 𝑥 ≤ 12.17.0 |
| iptime | a2004ns-r_firmware | 9.90.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a2004nsplus_firmware | 9.90.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a2004plus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a2004r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a2004se_firmware | 14.16.6 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a2008_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a3_firmware | 9.97.2 ≤ 𝑥 ≤ 10.07.2 |
| iptime | a3002mesh_firmware | 12.05.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a3003ns_firmware | 9.99.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a3004_firmware | 9.90.8 ≤ 𝑥 ≤ 10.08.2 |
| iptime | a3004-dual_firmware | 9.90.4 ≤ 𝑥 ≤ 10.07.2 |
| iptime | a3004m_firmware | 14.18.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a3004ns_firmware | 9.90.2 ≤ 𝑥 ≤ 10.09.4 |
| iptime | a3004ns-bcm_firmware | 9.95.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a3004ns-dual_firmware | 9.90.4 ≤ 𝑥 ≤ 12.09.4 |
| iptime | a3004ns-m_firmware | 10.05.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a3004t_firmware | 12.10.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a3004tw_firmware | 14.15.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a3008-mu_firmware | 10.08.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a304_firmware | 10.05.4 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a5004ns_firmware | 9.90.2 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a5004ns-m_firmware | 10.05.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a6004mx_firmware | 12.04.6 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a6004ns_firmware | 9.90.2 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a6004ns-m_firmware | 9.99.8 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a604_firmware | 9.90.8 ≤ 𝑥 ≤ 12.06.6 |
| iptime | a604-v3_firmware | 10.01.6 ≤ 𝑥 ≤ 10.07.2 |
| iptime | a604-v5_firmware | 10.09.2 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a604g-mu_firmware | 10.07.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a604g-skylife_firmware | 12.02.4 ≤ 𝑥 ≤ 12.12.4 |
| iptime | a604m_firmware | 10.06.4 ≤ 𝑥 ≤ 10.07.2 |
| iptime | a604mu_firmware | 12.12.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a604r_firmware | 10.09.2 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a604se_firmware | 14.17.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a604v_firmware | 9.90.8 ≤ 𝑥 ≤ 10.07.4 |
| iptime | a6ns-m_firmware | 10.01.6 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a7004m_firmware | 10.06.8 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a704ns-bcm_firmware | 9.95.8 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a7ns_firmware | 9.96.0 ≤ 𝑥 ≤ 11.00.4 |
| iptime | a8004bcm_firmware | 11.99.1 ≤ 𝑥 ≤ 12.16.2 |
| iptime | a8004itl_firmware | 11.00.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a8004ns-m_firmware | 9.99.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a8004t_firmware | 10.06.8 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a8004t-xr_firmware | 11.97.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a804ns-mu_firmware | 10.06.4 ≤ 𝑥 ≤ 12.10.2 |
| iptime | a8ns-m_firmware | 10.03.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a9004m_firmware | 10.05.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | a9004m-x2_firmware | 11.98.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | ew302n_firmware | 9.90.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n102e_firmware | 11.00.8 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n102eplus_firmware | 12.14.2 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n102i_firmware | 11.01.2 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n102iplus_firmware | 12.14.2 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n104_black_firmware | 9.93.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104e_firmware | 10.09.4 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n104eplus_firmware | 12.14.2 ≤ 𝑥 ≤ 12.15.2 |
| iptime | n104k_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104plus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104plus-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104q_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104q-i_firmware | 9.99.6 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n104r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n702eplus_firmware | 12.12.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n702r_firmware | 10.05.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n704-a3_firmware | 9.90.8 ≤ 𝑥 ≤ 10.06.8 |
| iptime | n704bcm_firmware | 9.90.8 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n704e_firmware | 11.98.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n704eplus_firmware | 12.14.2 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n704ns_firmware | 9.91.4 ≤ 𝑥 ≤ 9.96.0 |
| iptime | n704qca_firmware | 10.02.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n704v3_firmware | 9.90.8 ≤ 𝑥 ≤ 12.10.2 |
| iptime | n8004r_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n8004v_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n804_firmware | 9.91.2 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n804a_firmware | 9.91.2 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n804a3_firmware | 9.90.8 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n804r_firmware | 10.06.4 ≤ 𝑥 ≤ 12.16.2 |
| iptime | n804t_firmware | 9.91.2 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n804t3_firmware | 9.90.8 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n804v_firmware | 9.91.2 ≤ 𝑥 ≤ 9.96.8 |
| iptime | n904_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n904ns_firmware | 9.91.4 ≤ 𝑥 ≤ 9.96.0 |
| iptime | n904plus_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | n904v_firmware | 9.90.8 ≤ 𝑥 ≤ 10.02.2 |
| iptime | smart_firmware | 9.90.8 ≤ 𝑥 ≤ 9.94.2 |
| iptime | q1_firmware | 9.91.2 |
| iptime | q304_firmware | 9.91.2 |
| iptime | q504_firmware | 9.91.2 |
| iptime | q604_firmware | 9.91.2 |
| iptime | t16000_firmware | 9.91.2 ≤ 𝑥 ≤ 11.03.6 |
| iptime | t16000m_firmware | 12.07.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | t24000_firmware | 9.91.2 ≤ 𝑥 ≤ 11.03.6 |
| iptime | t24000m_firmware | 12.07.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | t3004_firmware | 9.90.8 ≤ 𝑥 ≤ 12.07.6 |
| iptime | t3008_firmware | 9.90.8 ≤ 𝑥 ≤ 12.09.6 |
| iptime | t5004_firmware | 11.96.4 ≤ 𝑥 ≤ 14.19.4 |
| iptime | t5008_firmware | 11.98.2 ≤ 𝑥 ≤ 14.19.4 |
| iptime | v304_firmware | 9.91.2 |
| iptime | v504_firmware | 9.90.8 ≤ 𝑥 ≤ 12.15.2 |
| iptime | v508_firmware | 10.02.2 ≤ 𝑥 ≤ 10.06.4 |
𝑥
= Vulnerable software versions