CVE-2025-55423

🗓️ 20 Jan 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 12 Views🌐 WEB

CVE-2025-55423: os command injection in ipTIME routers across multiple models and firmware ranges via upnp_relay().

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Code Injection in Iptime N104S-R1_Firmware	22 May 202610:33	–	githubexploit
ATTACKERKB	CVE-2025-55423	20 Jan 202600:00	–	attackerkb
Circl	CVE-2025-55423	20 Jan 202619:23	–	circl
CNNVD	EFM ipTIME Routers security vulnerabilities	20 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-55423	20 Jan 202600:00	–	cvelist
EUVD	EUVD-2026-3376	20 Jan 202600:00	–	euvd
NVD	CVE-2025-55423	20 Jan 202618:16	–	nvd
OSV	CVE-2025-55423	20 Jan 202618:16	–	osv
Positive Technologies	PT-2026-3636	20 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-55423	21 Jan 202600:30	–	redhatcve

NVD

Node

iptime n104s-r1_firmwareRange9.90.8–10.02.2

AND

iptime n104s-r1Match-

Node

iptime n104v_firmwareRange9.90.8–10.06.8

AND

iptime n104vMatch-

Node

iptime n1e_firmwareRange9.90.8–10.06.8

AND

iptime n1eMatch-

Node

iptime n1plus_firmwareRange9.90.8–10.06.8

AND

iptime n1plusMatch-

Node

iptime n1plus-i_firmwareRange9.99.6–10.06.8

AND

iptime n1plus-iMatch-

Node

iptime n1v_firmwareRange11.01.2–12.07.6

AND

iptime n1vMatch-

Node

iptime n2e_firmwareRange9.90.8–10.06.8

AND

iptime n2eMatch-

Node

iptime n2eplus_firmwareRange9.90.8–10.06.8

AND

iptime n2eplusMatch-

Node

iptime n2plus_firmwareRange9.90.8–10.06.8

AND

iptime n2plusMatch-

Node

iptime n2plus-i_firmwareRange9.99.6–10.06.8

AND

iptime n2plus-iMatch-

Node

iptime n2v_firmwareRange10.09.2–12.16.8

AND

iptime n2vMatch-

Node

iptime n2vs_firmwareMatch12.16.8

AND

iptime n2vsMatch-

Node

iptime n3_firmwareRange9.93.2–10.06.8

AND

iptime n3Match-

Node

iptime n3-i_firmwareRange9.99.6–10.06.8

AND

iptime n3-iMatch-

Node

iptime n5_firmwareRange9.90.8–10.06.8

AND

iptime n5Match-

Node

iptime n5-i_firmwareRange9.99.6–10.06.8

AND

iptime n5-iMatch-

Node

iptime n6_firmwareRange9.96.8–10.06.8

AND

iptime n6Match-

Node

iptime n600_firmwareRange10.00.8–12.16.2

AND

iptime n600Match-

Node

iptime n6004r_firmwareRange9.90.8–10.02.2

AND

iptime n6004rMatch-

Node

iptime n602e_firmwareRange11.96.6–12.16.8

AND

iptime n602eMatch-

Node

iptime n602eplus_firmwareRange12.14.2–12.16.2

AND

iptime n602eplusMatch-

Node

iptime n602se_firmwareRange14.19.0–14.19.4

AND

iptime n602seMatch-

Node

iptime n604_black_firmwareRange9.93.8–12.16.2

AND

iptime n604_blackMatch-

Node

iptime n604a_firmwareRange9.90.8–10.06.8

AND

iptime n604aMatch-

Node

iptime n604e_firmwareRange10.09.2–14.19.4

AND

iptime n604eMatch-

Node

iptime n604eplus_firmwareRange12.14.2–14.19.4

AND

iptime n604eplusMatch-

Node

iptime n604plus_firmwareRange9.90.8–12.15.2

AND

iptime n604plusMatch-

Node

iptime n604plus-i_firmwareRange9.99.6–12.14.6

AND

iptime n604plus-iMatch-

Node

iptime n604r_firmwareRange9.90.8–10.06.8

AND

iptime n604rMatch-

Node

iptime n604rplus_firmwareRange9.90.8–10.06.8

AND

iptime n604rplusMatch-

Node

iptime n604rplus-i_firmwareRange9.99.6–10.06.8

AND

iptime n604rplus-iMatch-

Node

iptime n604s_firmwareRange9.90.8–10.06.8

AND

iptime n604sMatch-

Node

iptime n604se_firmwareRange14.18.4–14.19.4

AND

iptime n604seMatch-

Node

iptime n604t_firmwareRange9.90.8–10.03.2

AND

iptime n604tMatch-

Node

iptime n604tplus_firmwareRange9.90.8–10.03.2

AND

iptime n604tplusMatch-

Node

iptime n604v_firmwareRange9.90.8–10.06.8

AND

iptime n604vMatch-

Node

iptime n604vplus_firmwareRange9.90.8–10.06.8

AND

iptime n604vplusMatch-

Node

iptime n7004ns_firmwareMatch9.91.2

AND

iptime n7004nsMatch-

Node

iptime n702bcm_firmwareRange9.90.8–12.16.2

AND

iptime n702bcmMatch-

Node

iptime n702e_firmwareRange10.09.2–12.16.2

AND

iptime n702eMatch-

Node

iptime ax11000_firmwareRange14.16.6–14.19.4

AND

iptime ax11000Match-

Node

iptime ax2002mesh_firmwareRange14.16.6–14.19.4

AND

iptime ax2002meshMatch-

Node

iptime ax2004_firmwareRange14.17.4–14.19.4

AND

iptime ax2004Match-

Node

iptime ax2004bcm_firmwareRange12.04.2–14.19.4

AND

iptime ax2004bcmMatch-

Node

iptime ax2004m_firmwareRange14.02.0–14.19.4

AND

iptime ax2004mMatch-

Node

iptime ax3004bcm_firmwareRange14.16.2–14.19.4

AND

iptime ax3004bcmMatch-

Node

iptime ax3004itl_firmwareRange12.01.2–14.19.4

AND

iptime ax3004itlMatch-

Node

iptime ax8004bcm_firmwareRange11.97.2–14.19.4

AND

iptime ax8004bcmMatch-

Node

iptime ax8004m_firmwareRange14.05.2–14.19.4

AND

iptime ax8004mMatch-

Node

iptime ax8008m_firmwareRange14.15.4–14.19.4

AND

iptime ax8008mMatch-

Node

iptime a1_firmwareRange9.96.8–10.07.4

AND

iptime a1Match-

Node

iptime a1004_firmwareRange9.90.8–12.16.2

AND

iptime a1004Match-

Node

iptime a1004ns_firmwareRange9.96.0–12.16.2

AND

iptime a1004nsMatch-

Node

iptime a1004v_firmwareRange9.90.8–12.16.2

AND

iptime a1004vMatch-

Node

iptime a104_firmwareRange9.90.8–10.03.8

AND

iptime a104Match-

Node

iptime a104ns_firmwareRange9.96.0–12.16.2

AND

iptime a104nsMatch-

Node

iptime a104r_firmwareRange9.90.8–10.07.4

iptime a104r_firmwareMatch-

AND

iptime a104rMatch-

Node

iptime a2003mu_firmwareRange12.13.0–12.16.2

AND

iptime a2003muMatch-

Node

iptime a2003ns-mu_firmwareRange10.00.6–12.16.2

AND

iptime a2003ns-muMatch-

Node

iptime a2004_firmwareRange9.90.8–10.07.4

AND

iptime a2004Match-

Node

iptime a2004mu_firmwareRange10.08.6–12.17.0

AND

iptime a2004muMatch-

Node

iptime a2004ns_firmwareRange9.90.8–11.00.4

AND

iptime a2004nsMatch-

Node

iptime a2004ns-mu_firmwareRange10.08.6–12.17.0

AND

iptime a2004ns-muMatch-

Node

iptime a2004ns-r_firmwareRange9.90.8–11.00.4

AND

iptime a2004ns-rMatch-

Node

iptime a2004nsplus_firmwareRange9.90.8–11.00.4

AND

iptime a2004nsplusMatch-

Node

iptime a2004plus_firmwareRange9.90.8–10.07.4

AND

iptime a2004plusMatch-

Node

iptime a2004r_firmwareRange9.90.8–10.07.4

AND

iptime a2004rMatch-

Node

iptime a2004se_firmwareRange14.16.6–14.19.4

AND

iptime a2004seMatch-

Node

iptime a2008_firmwareRange9.90.8–10.07.4

AND

iptime a2008Match-

Node

iptime a3_firmwareRange9.97.2–10.07.2

AND

iptime a3Match-

Node

iptime a3002mesh_firmwareRange12.05.4–14.19.4

AND

iptime a3002meshMatch-

Node

iptime a3003ns_firmwareRange9.99.8–11.00.4

AND

iptime a3003nsMatch-

Node

iptime a3004_firmwareRange9.90.8–10.08.2

AND

iptime a3004Match-

Node

iptime a3004-dual_firmwareRange9.90.4–10.07.2

AND

iptime a3004-dualMatch-

Node

iptime a3004m_firmwareRange14.18.4–14.19.4

AND

iptime a3004mMatch-

Node

iptime a3004ns_firmwareRange9.90.2–10.09.4

AND

iptime a3004nsMatch-

Node

iptime a3004ns-bcm_firmwareRange9.95.8–11.00.4

AND

iptime a3004ns-bcmMatch-

Node

iptime a3004ns-dual_firmwareRange9.90.4–12.09.4

AND

iptime a3004ns-dualMatch-

Node

iptime a3004ns-m_firmwareRange10.05.4–14.19.4

AND

iptime a3004ns-mMatch-

Node

iptime a3004t_firmwareRange12.10.2–14.19.4

AND

iptime a3004tMatch-

Node

iptime a3004tw_firmwareRange14.15.2–14.19.4

AND

iptime a3004twMatch-

Node

iptime a3008-mu_firmwareRange10.08.4–14.19.4

AND

iptime a3008-muMatch-

Node

iptime a304_firmwareRange10.05.4–10.07.4

AND

iptime a304Match-

Node

iptime a5004ns_firmwareRange9.90.2–11.00.4

AND

iptime a5004nsMatch-

Node

iptime a5004ns-m_firmwareRange10.05.4–14.19.4

AND

iptime a5004ns-mMatch-

Node

iptime a6004mx_firmwareRange12.04.6–14.19.4

AND

iptime a6004mxMatch-

Node

iptime a6004ns_firmwareRange9.90.2–11.00.4

AND

iptime a6004nsMatch-

Node

iptime a6004ns-m_firmwareRange9.99.8–14.19.4

AND

iptime a6004ns-mMatch-

Node

iptime a604_firmwareRange9.90.8–12.06.6

AND

iptime a604Match-

Node

iptime a604-v3_firmwareRange10.01.6–10.07.2

AND

iptime a604-v3Match-

Node

iptime a604-v5_firmwareRange10.09.2–12.16.2

AND

iptime a604-v5Match-

Node

iptime a604g-mu_firmwareRange10.07.4–12.16.2

AND

iptime a604g-muMatch-

Node

iptime a604g-skylife_firmwareRange12.02.4–12.12.4

AND

iptime a604g-skylifeMatch-

Node

iptime a604m_firmwareRange10.06.4–10.07.2

AND

iptime a604mMatch-

Node

iptime a604mu_firmwareRange12.12.4–12.16.2

AND

iptime a604muMatch-

Node

iptime a604r_firmwareRange10.09.2–12.16.2

AND

iptime a604rMatch-

Node

iptime a604se_firmwareRange14.17.2–14.19.4

AND

iptime a604seMatch-

Node

iptime a604v_firmwareRange9.90.8–10.07.4

AND

iptime a604vMatch-

Node

iptime a6ns-m_firmwareRange10.01.6–14.19.4

AND

iptime a6ns-mMatch-

Node

iptime a7004m_firmwareRange10.06.8–14.19.4

AND

iptime a7004mMatch-

Node

iptime a704ns-bcm_firmwareRange9.95.8–11.00.4

AND

iptime a704ns-bcmMatch-

Node

iptime a7ns_firmwareRange9.96.0–11.00.4

AND

iptime a7nsMatch-

Node

iptime a8004bcm_firmwareRange11.99.1–12.16.2

AND

iptime a8004bcmMatch-

Node

iptime a8004itl_firmwareRange11.00.4–14.19.4

AND

iptime a8004itlMatch-

Node

iptime a8004ns-m_firmwareRange9.99.2–14.19.4

AND

iptime a8004ns-mMatch-

Node

iptime a8004t_firmwareRange10.06.8–14.19.4

AND

iptime a8004tMatch-

Node

iptime a8004t-xr_firmwareRange11.97.2–14.19.4

AND

iptime a8004t-xrMatch-

Node

iptime a804ns-mu_firmwareRange10.06.4–12.10.2

AND

iptime a804ns-muMatch-

Node

iptime a8ns-m_firmwareRange10.03.2–14.19.4

AND

iptime a8ns-mMatch-

Node

iptime a9004m_firmwareRange10.05.4–14.19.4

AND

iptime a9004mMatch-

Node

iptime a9004m-x2_firmwareRange11.98.2–14.19.4

AND

iptime a9004m-x2Match-

Node

iptime ew302n_firmwareRange9.90.8–12.16.2

AND

iptime ew302nMatch-

Node

iptime n102e_firmwareRange11.00.8–12.15.2

AND

iptime n102eMatch-

Node

iptime n102eplus_firmwareRange12.14.2–12.15.2

AND

iptime n102eplusMatch-

Node

iptime n102i_firmwareRange11.01.2–12.15.2

AND

iptime n102iMatch-

Node

iptime n102iplus_firmwareRange12.14.2–12.15.2

AND

iptime n102iplusMatch-

Node

iptime n104_black_firmwareRange9.93.8–10.06.8

AND

iptime n104_blackMatch-

Node

iptime n104e_firmwareRange10.09.4–12.15.2

AND

iptime n104eMatch-

Node

iptime n104eplus_firmwareRange12.14.2–12.15.2

AND

iptime n104eplusMatch-

Node

iptime n104k_firmwareRange9.90.8–10.06.8

AND

iptime n104kMatch-

Node

iptime n104plus_firmwareRange9.90.8–10.06.8

AND

iptime n104plusMatch-

Node

iptime n104plus-i_firmwareRange9.99.6–10.06.8

AND

iptime n104plus-iMatch-

Node

iptime n104q_firmwareRange9.90.8–10.06.8

AND

iptime n104qMatch-

Node

iptime n104q-i_firmwareRange9.99.6–10.06.8

AND

iptime n104q-iMatch-

Node

iptime n104r_firmwareRange9.90.8–10.06.8

AND

iptime n104rMatch-

Node

iptime n702eplus_firmwareRange12.12.4–12.16.2

AND

iptime n702eplusMatch-

Node

iptime n702r_firmwareRange10.05.8–10.06.8

AND

iptime n702rMatch-

Node

iptime n704-a3_firmwareRange9.90.8–10.06.8

AND

iptime n704-a3Match-

Node

iptime n704bcm_firmwareRange9.90.8–12.16.2

AND

iptime n704bcmMatch-

Node

iptime n704e_firmwareRange11.98.4–12.16.2

AND

iptime n704eMatch-

Node

iptime n704eplus_firmwareRange12.14.2–12.16.2

AND

iptime n704eplusMatch-

Node

iptime n704ns_firmwareRange9.91.4–9.96.0

AND

iptime n704nsMatch-

Node

iptime n704qca_firmwareRange10.02.4–12.16.2

AND

iptime n704qcaMatch-

Node

iptime n704v3_firmwareRange9.90.8–12.10.2

AND

iptime n704v3Match-

Node

iptime n8004r_firmwareRange9.90.8–10.02.2

AND

iptime n8004rMatch-

Node

iptime n8004v_firmwareRange9.90.8–10.02.2

AND

iptime n8004vMatch-

Node

iptime n804_firmwareRange9.91.2–9.96.8

AND

iptime n804Match-

Node

iptime n804a_firmwareRange9.91.2–9.96.8

AND

iptime n804aMatch-

Node

iptime n804a3_firmwareRange9.90.8–9.96.8

AND

iptime n804a3Match-

Node

iptime n804r_firmwareRange10.06.4–12.16.2

AND

iptime n804rMatch-

Node

iptime n804t_firmwareRange9.91.2–9.96.8

AND

iptime n804tMatch-

Node

iptime n804t3_firmwareRange9.90.8–9.96.8

AND

iptime n804t3Match-

Node

iptime n804v_firmwareRange9.91.2–9.96.8

AND

iptime n804vMatch-

Node

iptime n904_firmwareRange9.90.8–10.02.2

AND

iptime n904Match-

Node

iptime n904ns_firmwareRange9.91.4–9.96.0

AND

iptime n904nsMatch-

Node

iptime n904plus_firmwareRange9.90.8–10.02.2

AND

iptime n904plusMatch-

Node

iptime n904v_firmwareRange9.90.8–10.02.2

AND

iptime n904vMatch-

Node

iptime smart_firmwareRange9.90.8–9.94.2

AND

iptime smartMatch-

Node

iptime q1_firmwareMatch9.91.2

AND

iptime q1Match-

Node

iptime q304_firmwareMatch9.91.2

AND

iptime q304Match-

Node

iptime q504_firmwareMatch9.91.2

AND

iptime q504Match-

Node

iptime q604_firmwareMatch9.91.2

AND

iptime q604Match-

Node

iptime t16000_firmwareRange9.91.2–11.03.6

AND

iptime t16000Match-

Node

iptime t16000m_firmwareRange12.07.4–14.19.4

AND

iptime t16000mMatch-

Node

iptime t24000_firmwareRange9.91.2–11.03.6

AND

iptime t24000Match-

Node

iptime t24000m_firmwareRange12.07.4–14.19.4

AND

iptime t24000mMatch-

Node

iptime t3004_firmwareRange9.90.8–12.07.6

AND

iptime t3004Match-

Node

iptime t3008_firmwareRange9.90.8–12.09.6

AND

iptime t3008Match-

Node

iptime t5004_firmwareRange11.96.4–14.19.4

AND

iptime t5004Match-

Node

iptime t5008_firmwareRange11.98.2–14.19.4

AND

iptime t5008Match-

Node

iptime v304_firmwareMatch9.91.2

AND

iptime v304Match-

Node

iptime v504_firmwareRange9.90.8–12.15.2

AND

iptime v504Match-

Node

iptime v508_firmwareRange10.02.2–10.06.4

AND

iptime v508Match-

Source	Link
docs	www.docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit
github	www.github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.md
github	www.github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.json
iptime	www.iptime.com/iptime/

Parameter	Position	Path	Description	CWE
igd_url	path	10.0.11.234:8080/87895a19/upnp/control/WANIPConn1;PWNED	Unvalidated UPnP controlURL is passed to system(), enabling command injection.	CWE-94
controlURL	path	10.0.11.234:8080/87895a19/upnp/control/WANIPConn1;PWNED	Unvalidated UPnP controlURL is passed to system(), enabling command injection.	CWE-94

30 Jan 2026 20:07Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.19.8

EPSS0.00665

SSVC

CWE-94