CVE-2026-1741
Medium · 6.6CVSS
6.6
EPSS
0.8%
Published
Feb 2, 2026
CISA due date
—
The record
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. CWE-912
- CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… CWE-912
- CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… CWE-912
- CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… CWE-912
- CVE-2026-11976 The official MonsterInsights Pro update distribution bucket… CWE-912
- CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… CWE-912
- CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic… CWE-912
- CVE-2026-41446 Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain… CWE-912