High severity · published May 10, 2026
CVE-2026-8234
EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security_5g leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
ipTIME A8004T · EFM
14.18.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8234
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8234
github.com
https://github.com/Kiciot/cve/issues/5
vuldb.com
https://vuldb.com/submit/808865
vuldb.com
https://vuldb.com/vuln/362454
vuldb.com
https://vuldb.com/vuln/362454/cti
More from ipTIME A8004T
9.8
CVE-2026-1740
EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication
7.2
CVE-2026-1742
EFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted upload
6.6
CVE-2026-1741
EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor