🚨 NEW ROUTER CVE — PUBLIC EXPLOIT AVAILABLE FOR AN ipTIME COMMAND-INJECTION VULNERABILITY CVE-2026-90847 CVSS: 9.1 CyberSignal Priority: 🟠 HIGH A new CVE published TODAY affects: EFM ipTIME C200E Firmware 1.094. The vulnerable component: iux_set.cgi inside: SYSTEM SETUP. The weakness: CWE-78 OS COMMAND INJECTION. An attacker able to reach the vulnerable management interface can manipulate input supplied to the CGI endpoint and inject operating-system commands. MANAGEMENT INTERFACE ↓ malicious input ↓ iux_set.cgi ↓ shell command injection ↓ CODE EXECUTION. And there's another reason this deserves attention: PUBLIC EXPLOIT INFORMATION EXISTS. The CVE was formally published: SEPTEMBER 15, 2026. VulDB currently rates it: 9.1 / CRITICAL. Important caveat: The vulnerability is currently: ❌ NOT in CISA KEV. And I found no evidence that widespread exploitation has been confirmed. PUBLIC EXPLOIT ≠ ACTIVE EXPLOITATION. 🛡️ Defender action If operating the affected router: → check vendor firmware status → disable internet-facing management → restrict the management interface to trusted networks → monitor unexplained configuration changes → watch for unusual outbound traffic. 🧠 CyberSignal insight Router management interfaces remain one of the highest-leverage places attackers can gain control. Own the endpoint... you own one machine. Own the router... you potentially control what every machine behind it can reach. Sources: MITRE CVE · NVD references · VulDB Published September 15, 2026
Post summary
A new critical (CVSS 9.1) command-injection vulnerability (CVE-2026-90847) in ipTIME routers is disclosed with public exploit information but no confirmed active exploitation. Mitigation steps include restricting management access and checking for firmware updates.
