This vulnerability affects the EFM ipTIME AX8004M router version 15.09.0. It arises from improper input handling in the popen function of the /cgi/d.cgi CGI endpoint, where the fname parameter can be manipulated to inject OS commands. This allows an unauthenticated remote attacker to execute arbitrary commands on the device. The vulnerability has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary operating system commands on the affected device without authentication. This could lead to partial compromise of confidentiality, integrity, and availability of the device. However, the impact is rated medium severity due to limited scope of impact and lack of evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or issued a fix as of the latest information. Until a patch is available, consider restricting network access to the affected device's management interface to trusted sources only to reduce exposure.