Unrated severityNVD Advisory· Published Jan 20, 2026· Updated Jan 27, 2026
CVE-2025-55423
CVE-2025-55423
Description
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
Affected products
1- ipTIME/routerdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.