PT-2025-50570 · Efm · Iptime A3004T

Niix330 · Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-14485

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions EFM ipTIME A3004T version 14.19.0

Description A weakness exists in the Administrator Password Handler component of EFM ipTIME A3004T. The issue affects the show debug screen function within the /sess-bin/timepro.cgi file. Manipulation of the aaksjdkfj argument with the input !@dnjsrureljrm*& can lead to command injection. The attack can be carried out remotely, but is considered to have a rather high complexity and difficult exploitability. The exploit has been publicly released. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 14.19.0 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-14485

Affected Products

Iptime A3004T

References · 10

• 🔥 https://pan.baidu.com/s/12VsWYY-bf2-Kfufbs2dlXw?pwd=drt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14485 · Security Note
• https://t.me/cveNotify/145405 · Telegram Post
• https://vuldb.com/?ctiid.335768 · Note
• https://vuldb.com/?id.335768 · Note
• https://vuldb.com/?submit.702655 · Note
• https://t.me/CVEtracker/39439 · Telegram Post
• https://twitter.com/CVEnew/status/1999108881994461203 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999035313088241997 · Twitter Post
• https://yuque.com/yuqueyonghuexlgkz/zepczx/mf0uog9s2ycay4g2?singleDoc · Note