PT-2026-3636 · Iptime · Iptime Routers A7004M+40

Published 2026-01-20 · Updated 2026-01-21 · CVE-2025-55423

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ipTIME routers A2003NS-MU versions 10.00.6 through 12.16.2 ipTIME routers N600 versions 10.00.8 through 12.16.2 ipTIME routers A604-V3 versions 10.01.6 through 10.07.2 ipTIME routers A6ns-M versions 10.01.6 through 14.19.4 ipTIME routers V508 versions 10.02.2 through 10.06.4 ipTIME routers N704QCA versions 10.02.4 through 12.16.2 ipTIME routers A8ns-M versions 10.03.2 through 14.19.4 ipTIME routers A304 versions 10.05.4 through 10.07.4 ipTIME routers A3004NS-M versions 10.05.4 through 14.19.4 ipTIME routers A5004NS-M versions 10.05.4 through 14.19.4 ipTIME routers A9004M versions 10.05.4 through 14.19.4 ipTIME routers N702R versions 10.05.8 through 10.06.8 ipTIME routers A604M versions 10.06.4 through 10.07.2 ipTIME routers A804NS-MU versions 10.06.4 through 12.10.2 ipTIME routers N804R versions 10.06.4 through 12.16.2 ipTIME routers A7004M versions 10.06.8 through 14.19.4 ipTIME routers A8004T versions 10.06.8 through 14.19.4 ipTIME routers A604G-MU versions 10.07.4 through 12.16.2 ipTIME routers A3008-MU versions 10.08.4 through 14.19.4 ipTIME routers A2004MU versions 10.08.6 through 12.17.0 ipTIME routers A2004NS-MU versions 10.08.6 through 12.17.0 ipTIME routers A604-V5 versions 10.09.2 through 12.16.2 ipTIME routers A604R versions 10.09.2 through 12.16.2 ipTIME routers N702E versions 10.09.2 through 12.16.2 ipTIME routers N2V versions 10.09.2 through 12.16.8 ipTIME routers N604E versions 10.09.2 through 14.19.4 ipTIME routers N104E versions 10.09.4 through 12.15.2 ipTIME routers A8004ITL versions 11.00.4 through 14.19.4 ipTIME routers N102E versions 11.00.8 through 12.15.2 ipTIME routers N1V versions 11.01.2 through 12.07.6 ipTIME routers N102i versions 11.01.2 through 12.15.2 ipTIME routers T5004 versions 11.96.4 through 14.19.4 ipTIME routers N602E versions 11.96.6 through 12.16.8 ipTIME routers AX8004BCM versions 11.97.2 through 14.19.4 ipTIME routers A8004T-XR versions 11.97.2 through 14.19.4 ipTIME routers A9004M-X2 versions 11.98.2 through 14.19.4 ipTIME routers T5008 versions 11.98.2 through 14.19.4 ipTIME routers N704E versions 11.98.4 through 12.16.2 ipTIME routers A8004BCM versions 11.99.1 through 12.16.2 ipTIME routers AX3004ITL versions 12.01.2 through 14.19.4 ipTIME routers A604G-skylife versions 12.02.4 through 12.12

Description The ipTIME routers are affected by an OS command injection issue. This issue is triggered through the upnp relay() function.

Recommendations ipTIME routers A2003NS-MU versions prior to 10.00.6 or after 12.16.2 ipTIME routers N600 versions prior to 10.00.8 or after 12.16.2 ipTIME routers A604-V3 versions prior to 10.01.6 or after 10.07.2 ipTIME routers A6ns-M versions prior to 10.01.6 or after 14.19.4 ipTIME routers V508 versions prior to 10.02.2 or after 10.06.4 ipTIME routers N704QCA versions prior to 10.02.4 or after 12.16.2 ipTIME routers A8ns-M versions prior to 10.03.2 or after 14.19.4 ipTIME routers A304 versions prior to 10.05.4 or after 10.07.4 ipTIME routers A3004NS-M versions prior to 10.05.4 or after 14.19.4 ipTIME routers A5004NS-M versions prior to 10.05.4 or after 14.19.4 ipTIME routers A9004M versions prior to 10.05.4 or after 14.19.4 ipTIME routers N702R versions prior to 10.05.8 or after 10.06.8 ipTIME routers A604M versions prior to 10.06.4 or after 10.07.2 ipTIME routers A804NS-MU versions prior to 10.06.4 or after 12.10.2 ipTIME routers N804R versions prior to 10.06.4 or after 12.16.2 ipTIME routers A7004M versions prior to 10.06.8 or after 14.19.4 ipTIME routers A8004T versions prior to 10.06.8 or after 14.19.4 ipTIME routers A604G-MU versions prior to 10.07.4 or after 12.16.2 ipTIME routers A3008-MU versions prior to 10.08.4 or after 14.19.4 ipTIME routers A2004MU versions prior to 10.08.6 or after 12.17.0 ipTIME routers A2004NS-MU versions prior to 10.08.6 or after 12.17.0 ipTIME routers A604-V5 versions prior to 10.09.2 or after 12.16.2 ipTIME routers A604R versions prior to 10.09.2 or after 12.16.2 ipTIME routers N702E versions prior to 10.09.2 or after 12.16.2 ipTIME routers N2V versions prior to 10.09.2 or after 12.16.8 ipTIME routers N604E versions prior to 10.09.2 or after 14.19.4 ipTIME routers N104E versions prior to 10.09.4 or after 12.15.2 ipTIME routers A8004ITL versions prior to 11.00.4 or after 14.19.4 ipTIME routers N102E versions prior to 11.00.8 or after 12.15.2 ipTIME routers N1V versions prior to 11.01.2 or after 12.07.6 ipTIME routers N102i versions prior to 11.01.2 or after 12.15.2 ipTIME routers T5004 versions prior to 11.96.4 or after 14.19.4 ipTIME routers N602E versions prior to 11.96.6 or after 12.16.8 ipTIME routers AX8004BCM versions prior to 11.97.2 or after 14.19.4 ipTIME routers A8004T-XR versions prior to 11.97.2 or after 14.19.4 ipTIME routers A9004M-X2 versions prior to 11.98.2 or after 14.19.4 ipTIME routers T5008 versions prior to 11.98.2 or after 14.19.4 ipTIME routers N704E versions prior to 11.98.4 or after 12.16.2 ipTIME routers A8004BCM versions prior to 11.99.1 or after 12.16.2 ipTIME routers AX3004ITL versions prior to 12.01.2 or after 14.19.4 ipTIME routers A604G-skylife versions prior to 12.02.4 or after 12.12

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-55423

Affected Products

Iptime Routers A2003Ns-Mu

Iptime Routers A2004Mu

Iptime Routers A2004Ns-Mu

Iptime Routers A3004Ns-M

Iptime Routers A3008-Mu

Iptime Routers A304

Iptime Routers A5004Ns-M

Iptime Routers A604-V3

Iptime Routers A604-V5

Iptime Routers A604G-Mu

Iptime Routers A604G-Skylife

Iptime Routers A604M

Iptime Routers A604R

Iptime Routers A6Ns-M

Iptime Routers A7004M

Iptime Routers A8004Bcm

Iptime Routers A8004Itl

Iptime Routers A8004T

Iptime Routers A8004T-Xr

Iptime Routers A804Ns-Mu

Iptime Routers A8Ns-M

Iptime Routers A9004M

Iptime Routers A9004M-X2

Iptime Routers Ax3004Itl

Iptime Routers Ax8004Bcm

Iptime Routers N102E

Iptime Routers N102I

Iptime Routers N104E

Iptime Routers N1V

Iptime Routers N2V

Iptime Routers N600

Iptime Routers N602E

Iptime Routers N604E

Iptime Routers N702E

Iptime Routers N702R

Iptime Routers N704E

Iptime Routers N704Qca

Iptime Routers N804R

Iptime Routers T5004

Iptime Routers T5008

Iptime Routers V508

References · 9

• 🔥 https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.md · Exploit
• 🔥 https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-55423 · Vendor Advisory
• https://iptime.com/iptime/?pageid=4&page_id=126&dfsid=3&dftid=583&uid=25203&mod=document · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55423 · Security Note
• https://docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit?usp=sharing · Note
• https://t.me/cveNotify/149403 · Telegram Post
• https://twitter.com/CVEnew/status/2013673276728582230 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014008177298415636 · Twitter Post