CVE-2020-7847: Iptime NAS-I Firmware

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

Affected products

• Iptime NAS-I Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS-Ii Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS-Iie Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS101 Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS1DUAL Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS2DUAL Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS3 Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS4 Firmware: before 1.4.36 (fixed in 1.4.36)
• Iptime NAS4DUAL Firmware: before 1.4.36 (fixed in 1.4.36)

Published 2021-02-23. Last modified 2026-06-17.