$ cve CVE-2025-55423 JSON

CVE-2025-55423

9.8

CRITICAL · CVSS 3.1 · EPSS 3.8% (pctl 90)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	3.82% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	none known
Published	2026-01-20
Last modified	2026-06-17

Affected (40)

Vendor	Product
iptime	n104s-r1
iptime	n104s-r1 firmware
iptime	n104v
iptime	n104v firmware
iptime	n1e
iptime	n1e firmware
iptime	n1plus
iptime	n1plus firmware
iptime	n1plus-i
iptime	n1plus-i firmware
iptime	n1v
iptime	n1v firmware
iptime	n2e
iptime	n2e firmware
iptime	n2eplus
iptime	n2eplus firmware
iptime	n2plus
iptime	n2plus firmware
iptime	n2plus-i
iptime	n2plus-i firmware
iptime	n2v
iptime	n2v firmware
iptime	n2vs
iptime	n2vs firmware
iptime	n3
iptime	n3 firmware
iptime	n3-i
iptime	n3-i firmware
iptime	n5
iptime	n5 firmware
iptime	n5-i
iptime	n5-i firmware
iptime	n6
iptime	n6 firmware
iptime	n600
iptime	n600 firmware
iptime	n6004r
iptime	n6004r firmware
iptime	n602e
iptime	n602e firmware

References

→ the Explorer · watch your stack · NVD