CVE-2026-19379 Overview
CVE-2026-19379 is an operating system command injection vulnerability [CWE-77] in the EFM ipTIME AX8004M router running firmware version 15.09.0. The flaw resides in the popen function call inside /cgi/d.cgi, where the fname argument is passed to a shell without proper sanitization. Remote attackers can inject arbitrary operating system commands through crafted HTTP requests to the CGI endpoint. The exploit has been publicly disclosed, and EFM did not respond to early disclosure attempts. No vendor patch is currently referenced in public advisories.
Critical Impact
Remote attackers can execute arbitrary operating system commands on affected ipTIME AX8004M devices without authentication, enabling full router compromise.
Affected Products
- EFM ipTIME AX8004M firmware version 15.09.0
- CGI Endpoint component (/cgi/d.cgi)
- Devices exposing the web management interface to untrusted networks
Discovery Timeline
- 2026-08-10 - CVE-2026-19379 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19379
Vulnerability Analysis
The vulnerability exists in the CGI handler /cgi/d.cgi on the ipTIME AX8004M router. The handler processes a user-supplied fname parameter and passes it directly to the popen C library function. Because popen invokes /bin/sh -c, any shell metacharacters supplied by the attacker are interpreted by the shell. This allows command chaining through characters such as ;, |, &, and backticks. The attack requires no authentication and can be initiated over the network against the device management interface.
Root Cause
The root cause is improper neutralization of special elements used in an operating system command [CWE-77]. The d.cgi binary constructs a shell command string using the fname request argument without input validation, allowlisting, or safe argument-passing APIs such as execve. Passing attacker-controlled data to popen in this manner is a well-known unsafe pattern in embedded router firmware.
Attack Vector
An unauthenticated remote attacker sends an HTTP request to /cgi/d.cgi with a malicious fname parameter containing shell metacharacters. The injected commands execute in the context of the CGI process, which on consumer routers typically runs with elevated privileges. Successful exploitation permits configuration tampering, credential theft, persistence installation, and pivoting into the internal network. Public disclosure of the exploit increases the likelihood of opportunistic scanning and mass exploitation.
Technical details are documented in the GitHub Vulnerability Report and VulDB entry for CVE-2026-19379.
Detection Methods for CVE-2026-19379
Indicators of Compromise
- HTTP requests to /cgi/d.cgi containing shell metacharacters (;, |, &, `, $() in the fname parameter.
- Outbound connections from the router to unexpected IP addresses following inbound CGI traffic.
- Unexpected processes spawned by the web server or CGI handler on the device.
- New or modified startup scripts, cron entries, or firmware configuration values on the router.
Detection Strategies
- Deploy network intrusion detection signatures that inspect HTTP request parameters targeting /cgi/d.cgi for command-injection payloads.
- Baseline expected management-plane traffic and alert on external source addresses reaching the router administration interface.
- Correlate router syslog output with perimeter firewall logs to identify anomalous command execution patterns.
Monitoring Recommendations
- Forward router and firewall logs to a centralized log platform for retention and correlation.
- Monitor DNS queries and egress traffic originating from the router itself, which is uncommon during normal operation.
- Track firmware version and configuration checksums to detect unauthorized modifications.
How to Mitigate CVE-2026-19379
Immediate Actions Required
- Restrict access to the router web management interface to trusted internal hosts only, and disable remote WAN-side administration.
- Place the affected device behind a segmentation boundary and block untrusted access to /cgi/d.cgi.
- Rotate router administrator credentials and any secrets that may have been exposed to a compromised device.
- Inspect affected routers for signs of compromise, including altered configurations and unexpected outbound connections.
Patch Information
No vendor patch is referenced in the public disclosure. According to the CVE record, EFM was contacted early but did not respond. Consult the VulDB advisory for updates, and monitor the EFM ipTIME support portal for future firmware releases addressing the d.cgi command injection.
Workarounds
- Disable remote administration and expose the management interface only on the LAN.
- Enforce network-layer access control lists that permit management traffic solely from authorized workstations.
- Consider replacing end-of-support or unpatched consumer routers with vendor-supported devices where firmware fixes are actively maintained.
- Deploy a web application firewall or upstream inspection point capable of blocking requests containing shell metacharacters targeting /cgi/d.cgi.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
