EFM ipTIME Routers security vulnerabilities

EFM ipTIME Routers are a series of routers produced by the South Korean company EFM. The EFM ipTIME Routers have a security vulnerability, which stems from an OS command injection vulnerability in the upnp-relay function. The following products and versions are affected: A2003NS-MU version 10.00....

CVE-2025-55423

A command injection vulnerability exists in the upnprelay function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system without proper validation or sanitization, allowing OS command injection...

CVE-2025-55423

A command injection vulnerability exists in the upnprelay function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system without proper validation or sanitization, allowing OS command injection...

PT-2026-3636

Name of the Vulnerable Software and Affected Versions ipTIME routers A2003NS-MU versions 10.00.6 through 12.16.2 ipTIME routers N600 versions 10.00.8 through 12.16.2 ipTIME routers A604-V3 versions 10.01.6 through 10.07.2 ipTIME routers A6ns-M versions 10.01.6 through 14.19.4 ipTIME routers V508...

CVE-2025-55423

A command injection vulnerability exists in the upnp_relay() function of multiple ipTIME router models. The flaw occurs because the controlURL value, used to pass port-forwarding information to an upstream router, is passed to the system() function without proper validation or sanitization. An at...

MiracleLinux 4 : python-2.6.6-66.0.1.AXS4 (AXSA:2016-645:06)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-645:06 advisory. Coherence is a framework written in Python enabling applications to participate in digital living networks, such as the UPnP universe. Security issues fixed...

MiracleLinux 4 : python-2.6.6-64.0.1.AXS4 (AXSA:2015-418:02)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-418:02 advisory. Coherence is a framework written in Python enabling applications to participate in digital living networks, such as the UPnP universe. Security issue...

CVE-2020-24375

A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3...

CVE-2020-24376

A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3...

CVE-2023-31998

A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices...

CVE-2020-10923

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A...

CVE-2020-10924

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2019-12780

The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication...

CVE-2025-11676

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 UPnP modules, which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 = Build 220801...

CVE-2025-11676 UPnP DOS in TL-WR940N V6

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 UPnP modules, which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 = Build 220801...

CVE-2025-11676: Improper Input Validation

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 UPnP modules, which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 = Build 220801...

CVE-2025-61498: Stack-based Buffer Overflow

A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service DoS via supplying a crafted packet...

CVE-2025-61498

A buffer overflow vulnerability exists in the UPnP service of the Tenda AC8 wireless router, specifically affecting Hardware version v03.03.10.01 . The issue originates from a boundary error when the service handles untrusted input, allowing an attacker to provide a crafted packet to cause a Deni...

CVE-2025-12212

A weakness has been identified in Tenda O3 1.0.0.102478. This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2025-12212 Tenda O3 setNetworkService GetValue stack-based overflow

A weakness has been identified in Tenda O3 1.0.0.102478. This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the...