CVE-2026-90847

8.5 highEPSS 3.4%

High (8.5). EPSS 3.4% chance of exploitation in the next 30 days.

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-09-15
Modified: 2026-09-15
Record from: the NVD, synced 2026-10-19

References

https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link
https://vuldb.com/cve/CVE-2026-90847
https://vuldb.com/submit/925831
https://vuldb.com/vuln/403400
https://vuldb.com/vuln/403400/cti

Check your stack JSON