Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-1741 A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Inter… https://www.cve.org/CVERecord?id=CVE-2026-1741
Post summary
The CVE-2026-1741 vulnerability is identified in the EFM ipTIME A8004T firmware, affecting the httpcon_check_session_url function in /sess-bin/d.cgi.
CVE-2026-1741 Remote Command Injection in EFM ipTIME A8004T Debug Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1741
Post summary
A new remote command injection vulnerability (CVE‑2026‑1741) has been identified in the EFM debug interface of the ipTIME A8004T router, but no proof of concept, exploit, or patch details are provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | iptime | a8004t | - | - | - |
| OS | iptime | a8004t_firmware | 14.18.2 | - | - |