Critical severity · published Sep 15, 2026
CVE-2026-90847
EFM ipTIME C200E System Setup iux_set.cgi os command injection
9.1
CVSS
3.4%
EPSS
No
On KEV
Description
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
ipTIME C200E · EFM
1.094 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90847
drive.google.com
https://drive.google.com/file/d/19WVo2tOImpmSEg3dFsmyB5Rw1aMQXyyd/view?usp=drive_link
vuldb.com
https://vuldb.com/cve/CVE-2026-90847
vuldb.com
https://vuldb.com/submit/925831
vuldb.com
https://vuldb.com/vuln/403400
vuldb.com
https://vuldb.com/vuln/403400/cti
youtu.be
https://youtu.be/qdFGRSpCiY0