This vulnerability exists in EFM ipTIME C200 firmware up to version 1.092. The flaw is in the ApplyRestore Endpoint's sub_408F90 function within the /cgi/iux_set.cgi file, where the RestoreFile argument is improperly handled, leading to command injection. An attacker with high privileges can remotely execute arbitrary commands on the device. The CVSS 4.0 base score is 8.6, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not issued any patch or official fix, and the exploit is publicly available.

Successful exploitation allows remote attackers with high privileges to execute arbitrary commands on the affected device, potentially compromising confidentiality, integrity, and availability of the system. Given the public availability of the exploit and lack of vendor response, affected devices are at significant risk if exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, affected users should consider restricting network access to the device, disabling vulnerable functionality if possible, or replacing the device until an official fix is released.