Threats tagged 'ghsa-6hpq-m5gp-6p39'

CVE-2026-19379 is a remote OS command injection vulnerability in the EFM ipTIME AX8004M 15.09.0 router. The flaw exists in the CGI endpoint /cgi/d.cgi, specifically in the popen function handling the fname argument. This vulnerability allows an unauthenticated attacker to execute arbitrary OS commands remotely. The vendor has not responded to disclosure requests and no patch information is available. The vulnerability has a CVSS 3.1 score of 7.3 (medium severity).