Home

Description

A weakness has been identified in EFM ipTIME A3004T 14.19.0. This vulnerability affects the function show_debug_screen of the file /sess-bin/timepro.cgi of the component Administrator Password Handler. This manipulation of the argument aaksjdkfj with the input !@dnjsrureljrm*& causes command injection. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED Reserved 2025-12-10 | Published 2025-12-11 | Updated 2025-12-11 | Assigner VulDB




LOW: 2.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 5.0CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
MEDIUM: 5.0CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4.6AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Command Injection

Injection

Product status

14.19.0
affected

Timeline

2025-12-10:Advisory disclosed
2025-12-10:VulDB entry created
2025-12-10:VulDB entry last update

Credits

niix330 (VulDB User) reporter

References

vuldb.com/?id.335768 (VDB-335768 | EFM ipTIME A3004T Administrator Password timepro.cgi show_debug_screen command injection) vdb-entry technical-description

vuldb.com/?ctiid.335768 (VDB-335768 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.702655 (Submit #702655 | EFM NETWORKS CO., LTD. ipTime A3004T 14.19.0 Command Injection) third-party-advisory

www.yuque.com/...ghuexlgkz/zepczx/mf0uog9s2ycay4g2?singleDoc related

pan.baidu.com/s/12VsWYY-bf2-Kfufbs2dlXw?pwd=drt exploit

cve.org (CVE-2025-14485)

nvd.nist.gov (CVE-2025-14485)

Download JSON