CVE-2026-1742 | EFM ipTIME A8004T 14.18.2 VPN Service /cgi/timepro.cgi commit_vpncli_file_upload unrestricted upload

A vulnerability labeled as critical has been found in EFM ipTIME A8004T 14.18.2. Affected by this vulnerability is the function commit_vpncli_file_upload of the file /cgi/timepro.cgi of the component VPN Service. Such manipulation leads to unrestricted upload.

This vulnerability is referenced as CVE-2026-1742. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.