CVE-2026-2550
Published: 16 February 2026
Summary
CVE-2026-2550 is a high-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2550 is an unrestricted file upload vulnerability in EFM iptime A6004MX firmware version 14.18.2. The issue affects the commit_vpncli_file_upload function within the /cgi/timepro.cgi file, stemming from CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type). Published on 2026-02-16, it carries a CVSS v3.1 base score of 9.8.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful manipulation enables high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary file uploads that could lead to full system compromise.
VulDB advisories and a related GitHub issue document the vulnerability, noting that an exploit has been made public and could be used. The vendor was contacted early for disclosure coordination but provided no response, and no patches or mitigations are mentioned in available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6098
Vulnerability details
A vulnerability was found in EFM iptime A6004MX 14.18.2. Affected is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be…
more
used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing CGI endpoint (no auth) directly enables remote exploitation of the web application (T1190) and subsequent deployment of arbitrary malicious files such as web shells (T1100) for code execution and full compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on the commit_vpncli_file_upload function in /cgi/timepro.cgi to prevent unauthorized remote file uploads due to improper access control.
Validates inputs to the vulnerable file upload function to block dangerous file types and unrestricted uploads as per CWE-434.
Restricts file types, sizes, and characteristics allowed in commit_vpncli_file_upload to mitigate unrestricted upload of arbitrary files.