A command injection vulnerability in the ipTIME AX8004M router allows unauthenticated attackers to execute arbitrary commands on the underlying system. The vulnerable component is the CGI handler at /cgi/d.cgi, which passes user-supplied parameters directly into a popen() call without sanitization. This is not a complex vulnerability — any parameter in the request becomes a shell command injection point. Firmware version 15.09.0 and earlier are affected.
The vendor was notified and did not respond. This is the analytically significant part. Do not wait for a patch. The non-response indicates either end-of-life status with no maintenance budget, or a vendor without the internal capacity or source access to remediate. Either condition produces the same outcome: the installed base will remain unpatched indefinitely.
The practical implication is that this CVE functions as a permanent exploitation recipe. Unlike memory corruption bugs that require version-specific ROP chains, command injection via popen() is version-agnostic — the same payload works across firmware versions where the handler persists. Attackers who reverse-engineered this handler can reuse the exact technique across the entire unpatched population with zero per-device development cost.
Defensive posture: assume unfixable. Replace the device if possible. If replacement isn't feasible, apply strict network segmentation — place the device behind a dedicated VLAN with no trust of the internal network, enforce egress filtering to limit beaconing capability, and disable any WAN-facing management interfaces. The CVSS score of 7.3 is misleading; the real threat is the structural condition of an unpatched, unmaintained perimeter device that will be mass-scanned and incorporated into botnets within days of any public attention. Monitor for outbound connections from AX8004M units to suspicious IPs and treat any successful compromise as inevitable rather than exceptional.