CVE-2025-55423
Published: 20 January 2026
Summary
CVE-2025-55423 is a critical-severity Code Injection (CWE-94) vulnerability in Iptime A104R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-55423 is a command injection vulnerability (CWE-94) in the upnp_relay() function affecting multiple ipTIME router models. The flaw occurs because the controlURL value, which passes port-forwarding information to an upper router, is directly supplied to the system() function without validation or sanitization, enabling OS command injection. Published on 2026-01-20, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers with network access can exploit this vulnerability with low complexity and no user interaction required. By supplying a crafted controlURL, they can inject arbitrary OS commands, achieving high-impact confidentiality, integrity, and availability compromises, such as full router takeover.
Mitigation guidance and affected product details are documented in vendor and researcher advisories, including the ipTIME support page (https://iptime.com/iptime/?pageid=4&page_id=126&dfsid=3&dftid=583&uid=25203&mod=document), a Google Sheet tracker (https://docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit?usp=sharing), and GitHub resources listing impacted models in JSON format (https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.json) and providing further analysis (https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.md).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3376
Vulnerability details
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in UPnP service enables unauthenticated remote exploitation of a public-facing application (T1190) and arbitrary OS command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation and sanitization of the controlURL input prior to passing it to the system() function, preventing OS command injection.
Requires timely identification, reporting, and correction of the specific command injection flaw in the upnp_relay() function via patching or updates.
Restricts or disables non-essential UPnP relay functionality on ipTIME routers, eliminating the vulnerable attack surface where possible.