Back to CVE records
Critical 9.8Published Jan 20, 2026
CVE-2025-55423A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is pass…
Updated under an hour ago ()
Does this affect you?
It affects iptime n104s-r1_firmware and 59 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-94
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
iptime n104s-r1_firmware iptime:n104s-r1_firmware | from 9.90.8 through 10.02.2 | NVD |
iptime n104v_firmware iptime:n104v_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n1e_firmware iptime:n1e_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n1plus_firmware iptime:n1plus_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n1plus-i_firmware iptime:n1plus-i_firmware | from 9.99.6 through 10.06.8 | NVD |
iptime n1v_firmware iptime:n1v_firmware | from 11.01.2 through 12.07.6 | NVD |
iptime n2e_firmware iptime:n2e_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n2eplus_firmware iptime:n2eplus_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n2plus_firmware iptime:n2plus_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n2plus-i_firmware iptime:n2plus-i_firmware | from 9.99.6 through 10.06.8 | NVD |
iptime n2v_firmware iptime:n2v_firmware | from 10.09.2 through 12.16.8 | NVD |
iptime n2vs_firmware iptime:n2vs_firmware | 12.16.8 | NVD |
iptime n3_firmware iptime:n3_firmware | from 9.93.2 through 10.06.8 | NVD |
iptime n3-i_firmware iptime:n3-i_firmware | from 9.99.6 through 10.06.8 | NVD |
iptime n5_firmware iptime:n5_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n5-i_firmware iptime:n5-i_firmware | from 9.99.6 through 10.06.8 | NVD |
iptime n6_firmware iptime:n6_firmware | from 9.96.8 through 10.06.8 | NVD |
iptime n600_firmware iptime:n600_firmware | from 10.00.8 through 12.16.2 | NVD |
iptime n6004r_firmware iptime:n6004r_firmware | from 9.90.8 through 10.02.2 | NVD |
iptime n602e_firmware iptime:n602e_firmware | from 11.96.6 through 12.16.8 | NVD |
iptime n602eplus_firmware iptime:n602eplus_firmware | from 12.14.2 through 12.16.2 | NVD |
iptime n602se_firmware iptime:n602se_firmware | from 14.19.0 through 14.19.4 | NVD |
iptime n604_black_firmware iptime:n604_black_firmware | from 9.93.8 through 12.16.2 | NVD |
iptime n604a_firmware iptime:n604a_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n604e_firmware iptime:n604e_firmware | from 10.09.2 through 14.19.4 | NVD |
iptime n604eplus_firmware iptime:n604eplus_firmware | from 12.14.2 through 14.19.4 | NVD |
iptime n604plus_firmware iptime:n604plus_firmware | from 9.90.8 through 12.15.2 | NVD |
iptime n604plus-i_firmware iptime:n604plus-i_firmware | from 9.99.6 through 12.14.6 | NVD |
iptime n604r_firmware iptime:n604r_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n604rplus_firmware iptime:n604rplus_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n604rplus-i_firmware iptime:n604rplus-i_firmware | from 9.99.6 through 10.06.8 | NVD |
iptime n604s_firmware iptime:n604s_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n604se_firmware iptime:n604se_firmware | from 14.18.4 through 14.19.4 | NVD |
iptime n604t_firmware iptime:n604t_firmware | from 9.90.8 through 10.03.2 | NVD |
iptime n604tplus_firmware iptime:n604tplus_firmware | from 9.90.8 through 10.03.2 | NVD |
iptime n604v_firmware iptime:n604v_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n604vplus_firmware iptime:n604vplus_firmware | from 9.90.8 through 10.06.8 | NVD |
iptime n7004ns_firmware iptime:n7004ns_firmware | 9.91.2 | NVD |
iptime n702bcm_firmware iptime:n702bcm_firmware | from 9.90.8 through 12.16.2 | NVD |
iptime n702e_firmware iptime:n702e_firmware | from 10.09.2 through 12.16.2 | NVD |
iptime ax11000_firmware iptime:ax11000_firmware | from 14.16.6 through 14.19.4 | NVD |
iptime ax2002mesh_firmware iptime:ax2002mesh_firmware | from 14.16.6 through 14.19.4 | NVD |
iptime ax2004_firmware iptime:ax2004_firmware | from 14.17.4 through 14.19.4 | NVD |
iptime ax2004bcm_firmware iptime:ax2004bcm_firmware | from 12.04.2 through 14.19.4 | NVD |
iptime ax2004m_firmware iptime:ax2004m_firmware | from 14.02.0 through 14.19.4 | NVD |
iptime ax3004bcm_firmware iptime:ax3004bcm_firmware | from 14.16.2 through 14.19.4 | NVD |
iptime ax3004itl_firmware iptime:ax3004itl_firmware | from 12.01.2 through 14.19.4 | NVD |
iptime ax8004bcm_firmware iptime:ax8004bcm_firmware | from 11.97.2 through 14.19.4 | NVD |
iptime ax8004m_firmware iptime:ax8004m_firmware | from 14.05.2 through 14.19.4 | NVD |
iptime ax8008m_firmware iptime:ax8008m_firmware | from 14.15.4 through 14.19.4 | NVD |
iptime a1_firmware iptime:a1_firmware | from 9.96.8 through 10.07.4 | NVD |
iptime a1004_firmware iptime:a1004_firmware | from 9.90.8 through 12.16.2 | NVD |
iptime a1004ns_firmware iptime:a1004ns_firmware | from 9.96.0 through 12.16.2 | NVD |
iptime a1004v_firmware iptime:a1004v_firmware | from 9.90.8 through 12.16.2 | NVD |
iptime a104_firmware iptime:a104_firmware | from 9.90.8 through 10.03.8 | NVD |
iptime a104ns_firmware iptime:a104ns_firmware | from 9.96.0 through 12.16.2 | NVD |
iptime a104r_firmware iptime:a104r_firmware | from 9.90.8 through 10.07.4; all versions | NVD |
iptime a2003mu_firmware iptime:a2003mu_firmware | from 12.13.0 through 12.16.2 | NVD |
iptime a2003ns-mu_firmware iptime:a2003ns-mu_firmware | from 10.00.6 through 12.16.2 | NVD |
iptime a2004_firmware iptime:a2004_firmware | from 9.90.8 through 10.07.4 | NVD |
References
- https://docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit?usp=sharingthird-party-advisory
- https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.mdexploit, third-party-advisory
- https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.jsonthird-party-advisory
- https://iptime.com/iptime/?pageid=4&page_id=126&dfsid=3&dftid=583&uid=25203&mod=documentvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.