CVE-2026-2550

8.9 highEPSS 0.7%

High (8.9). EPSS 0.7% chance of exploitation in the next 30 days.

A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-434
Published: 2026-02-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/LX-LX88/cve-new/issues/3
https://vuldb.com/?ctiid.346159
https://vuldb.com/?id.346159
https://vuldb.com/?submit.749986

Check your stack JSON