This vulnerability in EFM ipTIME C200 firmware version 1.092 allows an attacker to remotely execute arbitrary commands via command injection in the RestoreFile argument processed by the sub_408F90 function within the /cgi/iux_set.cgi component. The vulnerability requires high privileges and no user interaction but can be triggered remotely. The vendor has not provided any patch or mitigation guidance, and the exploit is publicly available, increasing the risk of potential attacks.

Successful exploitation allows remote attackers with high privileges to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This could impact device integrity, confidentiality, and availability. The vulnerability is rated with a CVSS 4.0 score of 8.6 (high severity). There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoint, disable remote management if possible, and monitor for unusual activity. Avoid using the vulnerable firmware version until a patch or official mitigation is released by the vendor.