CVE-2025-55423: Iptime a1004 Firmware

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.

Affected products

  • Iptime a1004 Firmware: from 9.90.8, up to and including 12.16.2
  • Iptime a1004ns Firmware: from 9.96.0, up to and including 12.16.2
  • Iptime a1004v Firmware: from 9.90.8, up to and including 12.16.2
  • Iptime a104 Firmware: from 9.90.8, up to and including 10.03.8
  • Iptime a104ns Firmware: from 9.96.0, up to and including 12.16.2
  • Iptime a104r Firmware: from 9.90.8, up to and including 10.07.4; affected versions not specified
  • Iptime a1 Firmware: from 9.96.8, up to and including 10.07.4
  • Iptime a2003mu Firmware: from 12.13.0, up to and including 12.16.2
  • Iptime a2003ns-Mu Firmware: from 10.00.6, up to and including 12.16.2
  • Iptime a2004 Firmware: from 9.90.8, up to and including 10.07.4
  • Iptime a2004mu Firmware: from 10.08.6, up to and including 12.17.0
  • Iptime a2004ns-Mu Firmware: from 10.08.6, up to and including 12.17.0
  • Iptime a2004ns-R Firmware: from 9.90.8, up to and including 11.00.4
  • Iptime a2004ns Firmware: from 9.90.8, up to and including 11.00.4
  • Iptime a2004nsplus Firmware: from 9.90.8, up to and including 11.00.4
  • Iptime a2004plus Firmware: from 9.90.8, up to and including 10.07.4
  • Iptime a2004r Firmware: from 9.90.8, up to and including 10.07.4
  • Iptime a2004se Firmware: from 14.16.6, up to and including 14.19.4
  • Iptime a2008 Firmware: from 9.90.8, up to and including 10.07.4
  • Iptime a3002mesh Firmware: from 12.05.4, up to and including 14.19.4
  • Iptime a3003ns Firmware: from 9.99.8, up to and including 11.00.4
  • Iptime a3004-Dual Firmware: from 9.90.4, up to and including 10.07.2
  • Iptime a3004 Firmware: from 9.90.8, up to and including 10.08.2
  • Iptime a3004m Firmware: from 14.18.4, up to and including 14.19.4
  • Iptime a3004ns-Bcm Firmware: from 9.95.8, up to and including 11.00.4
  • and 138 more

Published 2026-01-20. Last modified 2026-06-17.