CVE-2026-7833
Published: 05 May 2026
Summary
CVE-2026-7833 is a high-severity Injection (CWE-74) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-7833 is a command injection vulnerability affecting EFM ipTIME C200 router firmware versions up to 1.092. The issue resides in the sub_408F90 function of the /cgi/iux_set.cgi file within the ApplyRestore Endpoint component, where manipulation of the RestoreFile argument enables command injection. Published on 2026-05-05, it is associated with CWEs-74 and CWE-77.
The vulnerability is remotely exploitable over the network with low complexity and no user interaction required, though it demands high privileges (PR:H). An attacker with such access can achieve high impacts on confidentiality, integrity, and availability, earning a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Advisories note that the vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are detailed. An exploit is publicly available, as referenced in reports on GitHub and VULDB.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27319
Vulnerability details
A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component ApplyRestore Endpoint. This manipulation of the argument RestoreFile causes command injection. The attack can be…
more
initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing /cgi/iux_set.cgi ApplyRestore endpoint enables remote exploitation of the web interface (T1190) and arbitrary Unix shell command execution on the Linux-based router firmware (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the RestoreFile argument to block command injection in the ApplyRestore CGI endpoint.
Limits the high-privilege accounts that can reach the vulnerable sub_408F90 function, reducing the population able to supply malicious RestoreFile values.
Enforces explicit access-control checks on the /cgi/iux_set.cgi ApplyRestore endpoint so only authorized subjects may invoke it.