The vulnerability CVE-2026-90847 affects EFM ipTIME C200E version 1.094. It involves an OS command injection flaw in an unspecified function of the iux_set.cgi file within the System Setup component. This flaw enables remote attackers to execute arbitrary OS commands on the affected device. The vulnerability has a high CVSS 4.0 base score of 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. The exploit code has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the system, including unauthorized access, data manipulation, or denial of service. Given the critical CVSS score and the nature of OS command injection, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device, especially to the iux_set.cgi interface, to trusted users only. Monitor for any suspicious activity related to this vulnerability. Avoid exposing the device management interface to untrusted networks.