CVE-2025-55423
Critical
Description
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
SeverityCritical
CVSS9.8
Exploit probability—
ProductIptime N104s-r1 Firmware
PublishedJan 20, 2026
First seenJan 20, 2026
Weakness typeCWE-94Code injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| iptime n104s-r1_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n104v_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n1e_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n1plus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n1plus-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n1v_firmware | 11.01.2 ≤ v ≤ 12.07.6 | — |
| iptime n2e_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n2eplus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n2plus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n2plus-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n2v_firmware | 10.09.2 ≤ v ≤ 12.16.8 | — |
| iptime n2vs_firmware | 12.16.8 | — |
| iptime n3_firmware | 9.93.2 ≤ v ≤ 10.06.8 | — |
| iptime n3-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n5_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n5-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n6_firmware | 9.96.8 ≤ v ≤ 10.06.8 | — |
| iptime n600_firmware | 10.00.8 ≤ v ≤ 12.16.2 | — |
| iptime n6004r_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n602e_firmware | 11.96.6 ≤ v ≤ 12.16.8 | — |
| iptime n602eplus_firmware | 12.14.2 ≤ v ≤ 12.16.2 | — |
| iptime n602se_firmware | 14.19.0 ≤ v ≤ 14.19.4 | — |
| iptime n604_black_firmware | 9.93.8 ≤ v ≤ 12.16.2 | — |
| iptime n604a_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n604e_firmware | 10.09.2 ≤ v ≤ 14.19.4 | — |
| iptime n604eplus_firmware | 12.14.2 ≤ v ≤ 14.19.4 | — |
| iptime n604plus_firmware | 9.90.8 ≤ v ≤ 12.15.2 | — |
| iptime n604plus-i_firmware | 9.99.6 ≤ v ≤ 12.14.6 | — |
| iptime n604r_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n604rplus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n604rplus-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n604s_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n604se_firmware | 14.18.4 ≤ v ≤ 14.19.4 | — |
| iptime n604t_firmware | 9.90.8 ≤ v ≤ 10.03.2 | — |
| iptime n604tplus_firmware | 9.90.8 ≤ v ≤ 10.03.2 | — |
| iptime n604v_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n604vplus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n7004ns_firmware | 9.91.2 | — |
| iptime n702bcm_firmware | 9.90.8 ≤ v ≤ 12.16.2 | — |
| iptime n702e_firmware | 10.09.2 ≤ v ≤ 12.16.2 | — |
| iptime ax11000_firmware | 14.16.6 ≤ v ≤ 14.19.4 | — |
| iptime ax2002mesh_firmware | 14.16.6 ≤ v ≤ 14.19.4 | — |
| iptime ax2004_firmware | 14.17.4 ≤ v ≤ 14.19.4 | — |
| iptime ax2004bcm_firmware | 12.04.2 ≤ v ≤ 14.19.4 | — |
| iptime ax2004m_firmware | 14.02.0 ≤ v ≤ 14.19.4 | — |
| iptime ax3004bcm_firmware | 14.16.2 ≤ v ≤ 14.19.4 | — |
| iptime ax3004itl_firmware | 12.01.2 ≤ v ≤ 14.19.4 | — |
| iptime ax8004bcm_firmware | 11.97.2 ≤ v ≤ 14.19.4 | — |
| iptime ax8004m_firmware | 14.05.2 ≤ v ≤ 14.19.4 | — |
| iptime ax8008m_firmware | 14.15.4 ≤ v ≤ 14.19.4 | — |
| iptime a1_firmware | 9.96.8 ≤ v ≤ 10.07.4 | — |
| iptime a1004_firmware | 9.90.8 ≤ v ≤ 12.16.2 | — |
| iptime a1004ns_firmware | 9.96.0 ≤ v ≤ 12.16.2 | — |
| iptime a1004v_firmware | 9.90.8 ≤ v ≤ 12.16.2 | — |
| iptime a104_firmware | 9.90.8 ≤ v ≤ 10.03.8 | — |
| iptime a104ns_firmware | 9.96.0 ≤ v ≤ 12.16.2 | — |
| iptime a104r_firmware | 9.90.8 ≤ v ≤ 10.07.4, No range specified | — |
| iptime a2003mu_firmware | 12.13.0 ≤ v ≤ 12.16.2 | — |
| iptime a2003ns-mu_firmware | 10.00.6 ≤ v ≤ 12.16.2 | — |
| iptime a2004_firmware | 9.90.8 ≤ v ≤ 10.07.4 | — |
| iptime a2004mu_firmware | 10.08.6 ≤ v ≤ 12.17.0 | — |
| iptime a2004ns_firmware | 9.90.8 ≤ v ≤ 11.00.4 | — |
| iptime a2004ns-mu_firmware | 10.08.6 ≤ v ≤ 12.17.0 | — |
| iptime a2004ns-r_firmware | 9.90.8 ≤ v ≤ 11.00.4 | — |
| iptime a2004nsplus_firmware | 9.90.8 ≤ v ≤ 11.00.4 | — |
| iptime a2004plus_firmware | 9.90.8 ≤ v ≤ 10.07.4 | — |
| iptime a2004r_firmware | 9.90.8 ≤ v ≤ 10.07.4 | — |
| iptime a2004se_firmware | 14.16.6 ≤ v ≤ 14.19.4 | — |
| iptime a2008_firmware | 9.90.8 ≤ v ≤ 10.07.4 | — |
| iptime a3_firmware | 9.97.2 ≤ v ≤ 10.07.2 | — |
| iptime a3002mesh_firmware | 12.05.4 ≤ v ≤ 14.19.4 | — |
| iptime a3003ns_firmware | 9.99.8 ≤ v ≤ 11.00.4 | — |
| iptime a3004_firmware | 9.90.8 ≤ v ≤ 10.08.2 | — |
| iptime a3004-dual_firmware | 9.90.4 ≤ v ≤ 10.07.2 | — |
| iptime a3004m_firmware | 14.18.4 ≤ v ≤ 14.19.4 | — |
| iptime a3004ns_firmware | 9.90.2 ≤ v ≤ 10.09.4 | — |
| iptime a3004ns-bcm_firmware | 9.95.8 ≤ v ≤ 11.00.4 | — |
| iptime a3004ns-dual_firmware | 9.90.4 ≤ v ≤ 12.09.4 | — |
| iptime a3004ns-m_firmware | 10.05.4 ≤ v ≤ 14.19.4 | — |
| iptime a3004t_firmware | 12.10.2 ≤ v ≤ 14.19.4 | — |
| iptime a3004tw_firmware | 14.15.2 ≤ v ≤ 14.19.4 | — |
| iptime a3008-mu_firmware | 10.08.4 ≤ v ≤ 14.19.4 | — |
| iptime a304_firmware | 10.05.4 ≤ v ≤ 10.07.4 | — |
| iptime a5004ns_firmware | 9.90.2 ≤ v ≤ 11.00.4 | — |
| iptime a5004ns-m_firmware | 10.05.4 ≤ v ≤ 14.19.4 | — |
| iptime a6004mx_firmware | 12.04.6 ≤ v ≤ 14.19.4 | — |
| iptime a6004ns_firmware | 9.90.2 ≤ v ≤ 11.00.4 | — |
| iptime a6004ns-m_firmware | 9.99.8 ≤ v ≤ 14.19.4 | — |
| iptime a604_firmware | 9.90.8 ≤ v ≤ 12.06.6 | — |
| iptime a604-v3_firmware | 10.01.6 ≤ v ≤ 10.07.2 | — |
| iptime a604-v5_firmware | 10.09.2 ≤ v ≤ 12.16.2 | — |
| iptime a604g-mu_firmware | 10.07.4 ≤ v ≤ 12.16.2 | — |
| iptime a604g-skylife_firmware | 12.02.4 ≤ v ≤ 12.12.4 | — |
| iptime a604m_firmware | 10.06.4 ≤ v ≤ 10.07.2 | — |
| iptime a604mu_firmware | 12.12.4 ≤ v ≤ 12.16.2 | — |
| iptime a604r_firmware | 10.09.2 ≤ v ≤ 12.16.2 | — |
| iptime a604se_firmware | 14.17.2 ≤ v ≤ 14.19.4 | — |
| iptime a604v_firmware | 9.90.8 ≤ v ≤ 10.07.4 | — |
| iptime a6ns-m_firmware | 10.01.6 ≤ v ≤ 14.19.4 | — |
| iptime a7004m_firmware | 10.06.8 ≤ v ≤ 14.19.4 | — |
| iptime a704ns-bcm_firmware | 9.95.8 ≤ v ≤ 11.00.4 | — |
| iptime a7ns_firmware | 9.96.0 ≤ v ≤ 11.00.4 | — |
| iptime a8004bcm_firmware | 11.99.1 ≤ v ≤ 12.16.2 | — |
| iptime a8004itl_firmware | 11.00.4 ≤ v ≤ 14.19.4 | — |
| iptime a8004ns-m_firmware | 9.99.2 ≤ v ≤ 14.19.4 | — |
| iptime a8004t_firmware | 10.06.8 ≤ v ≤ 14.19.4 | — |
| iptime a8004t-xr_firmware | 11.97.2 ≤ v ≤ 14.19.4 | — |
| iptime a804ns-mu_firmware | 10.06.4 ≤ v ≤ 12.10.2 | — |
| iptime a8ns-m_firmware | 10.03.2 ≤ v ≤ 14.19.4 | — |
| iptime a9004m_firmware | 10.05.4 ≤ v ≤ 14.19.4 | — |
| iptime a9004m-x2_firmware | 11.98.2 ≤ v ≤ 14.19.4 | — |
| iptime ew302n_firmware | 9.90.8 ≤ v ≤ 12.16.2 | — |
| iptime n102e_firmware | 11.00.8 ≤ v ≤ 12.15.2 | — |
| iptime n102eplus_firmware | 12.14.2 ≤ v ≤ 12.15.2 | — |
| iptime n102i_firmware | 11.01.2 ≤ v ≤ 12.15.2 | — |
| iptime n102iplus_firmware | 12.14.2 ≤ v ≤ 12.15.2 | — |
| iptime n104_black_firmware | 9.93.8 ≤ v ≤ 10.06.8 | — |
| iptime n104e_firmware | 10.09.4 ≤ v ≤ 12.15.2 | — |
| iptime n104eplus_firmware | 12.14.2 ≤ v ≤ 12.15.2 | — |
| iptime n104k_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n104plus_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n104plus-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n104q_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n104q-i_firmware | 9.99.6 ≤ v ≤ 10.06.8 | — |
| iptime n104r_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n702eplus_firmware | 12.12.4 ≤ v ≤ 12.16.2 | — |
| iptime n702r_firmware | 10.05.8 ≤ v ≤ 10.06.8 | — |
| iptime n704-a3_firmware | 9.90.8 ≤ v ≤ 10.06.8 | — |
| iptime n704bcm_firmware | 9.90.8 ≤ v ≤ 12.16.2 | — |
| iptime n704e_firmware | 11.98.4 ≤ v ≤ 12.16.2 | — |
| iptime n704eplus_firmware | 12.14.2 ≤ v ≤ 12.16.2 | — |
| iptime n704ns_firmware | 9.91.4 ≤ v ≤ 9.96.0 | — |
| iptime n704qca_firmware | 10.02.4 ≤ v ≤ 12.16.2 | — |
| iptime n704v3_firmware | 9.90.8 ≤ v ≤ 12.10.2 | — |
| iptime n8004r_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n8004v_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n804_firmware | 9.91.2 ≤ v ≤ 9.96.8 | — |
| iptime n804a_firmware | 9.91.2 ≤ v ≤ 9.96.8 | — |
| iptime n804a3_firmware | 9.90.8 ≤ v ≤ 9.96.8 | — |
| iptime n804r_firmware | 10.06.4 ≤ v ≤ 12.16.2 | — |
| iptime n804t_firmware | 9.91.2 ≤ v ≤ 9.96.8 | — |
| iptime n804t3_firmware | 9.90.8 ≤ v ≤ 9.96.8 | — |
| iptime n804v_firmware | 9.91.2 ≤ v ≤ 9.96.8 | — |
| iptime n904_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n904ns_firmware | 9.91.4 ≤ v ≤ 9.96.0 | — |
| iptime n904plus_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime n904v_firmware | 9.90.8 ≤ v ≤ 10.02.2 | — |
| iptime smart_firmware | 9.90.8 ≤ v ≤ 9.94.2 | — |
| iptime q1_firmware | 9.91.2 | — |
| iptime q304_firmware | 9.91.2 | — |
| iptime q504_firmware | 9.91.2 | — |
| iptime q604_firmware | 9.91.2 | — |
| iptime t16000_firmware | 9.91.2 ≤ v ≤ 11.03.6 | — |
| iptime t16000m_firmware | 12.07.4 ≤ v ≤ 14.19.4 | — |
| iptime t24000_firmware | 9.91.2 ≤ v ≤ 11.03.6 | — |
| iptime t24000m_firmware | 12.07.4 ≤ v ≤ 14.19.4 | — |
| iptime t3004_firmware | 9.90.8 ≤ v ≤ 12.07.6 | — |
| iptime t3008_firmware | 9.90.8 ≤ v ≤ 12.09.6 | — |
| iptime t5004_firmware | 11.96.4 ≤ v ≤ 14.19.4 | — |
| iptime t5008_firmware | 11.98.2 ≤ v ≤ 14.19.4 | — |
| iptime v304_firmware | 9.91.2 | — |
| iptime v504_firmware | 9.90.8 ≤ v ≤ 12.15.2 | — |
| iptime v508_firmware | 10.02.2 ≤ v ≤ 10.06.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.