CVE-2026-1742

4.7 MEDIUM

📋 TL;DR

This vulnerability allows remote attackers to upload arbitrary files to the EFM ipTIME A8004T router via the VPN service component. Attackers can exploit this to potentially execute malicious code or compromise the device. All users running version 14.18.2 of this router are affected.

💻 Affected Systems

Products:
  • EFM ipTIME A8004T
Versions: 14.18.2
Operating Systems: Embedded router firmware
Default Config Vulnerable: ⚠️ Yes
Notes: Affects the VPN service component specifically; routers with VPN enabled are vulnerable.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise leading to persistent backdoor installation, credential theft, and use as a pivot point into internal networks.

🟠

Likely Case

Unauthorized file upload leading to temporary device disruption, configuration changes, or limited data exposure.

🟢

If Mitigated

File upload attempts are blocked or logged, preventing successful exploitation while maintaining VPN functionality.

🌐 Internet-Facing: HIGH - The vulnerability is remotely exploitable and affects internet-facing router interfaces.
🏢 Internal Only: MEDIUM - Internal exploitation possible if attacker gains network access, but requires specific targeting.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: None available

Restart Required: Yes

Instructions:

No official patch available. Contact vendor EFM for updates. If patch becomes available: 1. Download firmware from vendor site 2. Upload via admin interface 3. Apply update 4. Reboot router

🔧 Temporary Workarounds

Disable VPN Service

all

Temporarily disable the vulnerable VPN service component

Access router admin interface > VPN settings > Disable VPN service

Restrict WAN Access

linux

Block external access to VPN service ports

iptables -A INPUT -p tcp --dport [VPN_PORT] -j DROP
iptables -A INPUT -p udp --dport [VPN_PORT] -j DROP

🧯 If You Can't Patch

  • Isolate affected router in network segment with strict firewall rules
  • Implement network monitoring for unusual file upload attempts to /cgi/timepro.cgi

🔍 How to Verify

Check if Vulnerable:

Check router firmware version in admin interface; if version is 14.18.2, device is vulnerable.

Check Version:

Check router web interface at http://[router-ip]/ or use nmap -sV [router-ip]

Verify Fix Applied:

Verify firmware version has changed from 14.18.2 or test VPN file upload functionality is blocked.

📡 Detection & Monitoring

Log Indicators:

  • Unusual POST requests to /cgi/timepro.cgi
  • VPN service file upload events
  • Unexpected file creation in router filesystem

Network Indicators:

  • HTTP traffic to router on unusual ports
  • Multiple file upload attempts to VPN endpoint

SIEM Query:

source="router_logs" AND (uri="/cgi/timepro.cgi" OR process="vpn") AND action="upload"

📊 Metadata

CVE ID: CVE-2026-1742
CVSS v3 Score: 4.7 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-284
Published: February 2, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This