Critical severity9.8NVD Advisory· Published Jan 20, 2026· Updated Jun 17, 2026
CVE-2025-55423
CVE-2025-55423
Description
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
167cpe:2.3:o:iptime:a104r_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:iptime:a104r_firmware:*:*:*:*:*:*:*:*range: >=9.90.8,<=10.07.4
- cpe:2.3:o:iptime:a104r_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:a2003ns-mu_firmware:*:*:*:*:*:*:*:*Range: >=10.00.6,<=12.16.2
- cpe:2.3:o:iptime:a2004ns-mu_firmware:*:*:*:*:*:*:*:*Range: >=10.08.6,<=12.17.0
- cpe:2.3:o:iptime:a2004ns-r_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=11.00.4
- cpe:2.3:o:iptime:a2004nsplus_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=11.00.4
- cpe:2.3:o:iptime:a2004plus_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=10.07.4
- cpe:2.3:o:iptime:a3002mesh_firmware:*:*:*:*:*:*:*:*Range: >=12.05.4,<=14.19.4
- cpe:2.3:o:iptime:a3004-dual_firmware:*:*:*:*:*:*:*:*Range: >=9.90.4,<=10.07.2
- cpe:2.3:o:iptime:a3004ns-bcm_firmware:*:*:*:*:*:*:*:*Range: >=9.95.8,<=11.00.4
- cpe:2.3:o:iptime:a3004ns-dual_firmware:*:*:*:*:*:*:*:*Range: >=9.90.4,<=12.09.4
- cpe:2.3:o:iptime:a3004ns-m_firmware:*:*:*:*:*:*:*:*Range: >=10.05.4,<=14.19.4
- cpe:2.3:o:iptime:a3008-mu_firmware:*:*:*:*:*:*:*:*Range: >=10.08.4,<=14.19.4
- cpe:2.3:o:iptime:a5004ns-m_firmware:*:*:*:*:*:*:*:*Range: >=10.05.4,<=14.19.4
- cpe:2.3:o:iptime:a6004ns-m_firmware:*:*:*:*:*:*:*:*Range: >=9.99.8,<=14.19.4
- cpe:2.3:o:iptime:a604g-mu_firmware:*:*:*:*:*:*:*:*Range: >=10.07.4,<=12.16.2
- cpe:2.3:o:iptime:a604g-skylife_firmware:*:*:*:*:*:*:*:*Range: >=12.02.4,<=12.12.4
- cpe:2.3:o:iptime:a704ns-bcm_firmware:*:*:*:*:*:*:*:*Range: >=9.95.8,<=11.00.4
- cpe:2.3:o:iptime:a8004bcm_firmware:*:*:*:*:*:*:*:*Range: >=11.99.1,<=12.16.2
- cpe:2.3:o:iptime:a8004itl_firmware:*:*:*:*:*:*:*:*Range: >=11.00.4,<=14.19.4
- cpe:2.3:o:iptime:a8004ns-m_firmware:*:*:*:*:*:*:*:*Range: >=9.99.2,<=14.19.4
- cpe:2.3:o:iptime:a8004t-xr_firmware:*:*:*:*:*:*:*:*Range: >=11.97.2,<=14.19.4
- cpe:2.3:o:iptime:a804ns-mu_firmware:*:*:*:*:*:*:*:*Range: >=10.06.4,<=12.10.2
- cpe:2.3:o:iptime:a9004m-x2_firmware:*:*:*:*:*:*:*:*Range: >=11.98.2,<=14.19.4
- cpe:2.3:o:iptime:ax2002mesh_firmware:*:*:*:*:*:*:*:*Range: >=14.16.6,<=14.19.4
- cpe:2.3:o:iptime:ax2004bcm_firmware:*:*:*:*:*:*:*:*Range: >=12.04.2,<=14.19.4
- cpe:2.3:o:iptime:ax3004bcm_firmware:*:*:*:*:*:*:*:*Range: >=14.16.2,<=14.19.4
- cpe:2.3:o:iptime:ax3004itl_firmware:*:*:*:*:*:*:*:*Range: >=12.01.2,<=14.19.4
- cpe:2.3:o:iptime:ax8004bcm_firmware:*:*:*:*:*:*:*:*Range: >=11.97.2,<=14.19.4
- cpe:2.3:o:iptime:n102eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=12.15.2
- cpe:2.3:o:iptime:n102iplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=12.15.2
- cpe:2.3:o:iptime:n104_black_firmware:*:*:*:*:*:*:*:*Range: >=9.93.8,<=10.06.8
- cpe:2.3:o:iptime:n104eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=12.15.2
- cpe:2.3:o:iptime:n104plus-i_firmware:*:*:*:*:*:*:*:*Range: >=9.99.6,<=10.06.8
- cpe:2.3:o:iptime:n2vs_firmware:12.16.8:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:n602eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=12.16.2
- cpe:2.3:o:iptime:n604_black_firmware:*:*:*:*:*:*:*:*Range: >=9.93.8,<=12.16.2
- cpe:2.3:o:iptime:n604eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=14.19.4
- cpe:2.3:o:iptime:n604plus-i_firmware:*:*:*:*:*:*:*:*Range: >=9.99.6,<=12.14.6
- cpe:2.3:o:iptime:n604rplus-i_firmware:*:*:*:*:*:*:*:*Range: >=9.99.6,<=10.06.8
- cpe:2.3:o:iptime:n604rplus_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=10.06.8
- cpe:2.3:o:iptime:n604tplus_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=10.03.2
- cpe:2.3:o:iptime:n604vplus_firmware:*:*:*:*:*:*:*:*Range: >=9.90.8,<=10.06.8
- cpe:2.3:o:iptime:n7004ns_firmware:9.91.2:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:n702eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.12.4,<=12.16.2
- cpe:2.3:o:iptime:n704eplus_firmware:*:*:*:*:*:*:*:*Range: >=12.14.2,<=12.16.2
- cpe:2.3:o:iptime:q1_firmware:9.91.2:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:q304_firmware:9.91.2:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:q504_firmware:9.91.2:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:q604_firmware:9.91.2:*:*:*:*:*:*:*
- cpe:2.3:o:iptime:v304_firmware:9.91.2:*:*:*:*:*:*:*
- ipTIME/routerdescription
Patches
Vulnerability mechanics
References
4- github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.mdnvdExploitThird Party Advisory
- docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/editnvdThird Party Advisory
- github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.jsonnvdThird Party Advisory
- iptime.com/iptime/nvdVendor Advisory
News mentions
0No linked articles in our index yet.