EUVD-2026-60037
GHSA-6h4w-hx37-cqg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach A3004T web interface
-
DeliverySend crafted session-URL request
-
ExploitBypass httpcon_check_session_url auth check
-
ExecutionGain admin access to router
-
ImpactAlter config or pivot to LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ipTIME A3004T's HTTP web administration interface on firmware 14.19.0; because the flaw lies in the session-URL validation logic, no valid credentials or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure of the management interface: most home routers do NOT expose web administration to the WAN by default, so internet-wide exploitation depends on remote management being enabled - otherwise the attacker must be positioned on the local LAN/Wi-Fi segment. Confirmed prerequisites are the specific model (A3004T) and firmware (14.19.0); other firmware versions are unverified. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with High confidentiality, integrity, and availability impact) describes a remote, low-complexity, unauthenticated attack, consistent with a management-interface authentication bypass on a network device. The E:P (Proof-of-Concept) exploit maturity aligns with the reported public exploit. This is a genuine priority for any exposed device: authentication bypass plus network reachability means full administrative takeover with minimal skill. Tempering factors: no EPSS score is provided to gauge exploitation velocity, and the CVE is NOT in CISA KEV, so active in-the-wild exploitation is unconfirmed - risk is driven by public POC availability rather than observed attacks. The input vector's subsequent-system impact (SC:H/SI:H/SA:H) appears inflated for a self-contained router web daemon; the vulnerable system itself is what is compromised. Real-world exposure depends heavily on whether the web interface is reachable from the WAN, which is not the default for most home routers. |
| Exploit ScenarioDerived | An attacker who can reach the A3004T's web management interface - for example a device with remote administration exposed to the WAN, or an attacker already on the local Wi-Fi/LAN - sends a crafted request that manipulates the httpcon_check_session_url session check to bypass authentication. With public POC code available, the attacker gains administrative control of the router, from which they can alter DNS settings, open ports, sniff traffic, or pivot to internal hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Authentication bypass in EFM ipTIME A3004T (firmware 14.19.0) lets remote attackers defeat session validation through the httpcon_check_session_url function, granting unauthorized access to the router's web management interface. Publicly available exploit code exists, though the flaw is not yet listed in CISA KEV. The vendor was notified but did not respond, so no fix is currently available.
RemediationAI
No vendor-released patch identified at time of analysis - EFM was contacted before disclosure but did not respond, so a fixed firmware version cannot be cited. As compensating controls, disable remote (WAN-side) web administration so the management interface is not reachable from the internet; if remote management is required, restrict it to specific source IPs via ACL or place it behind a VPN. Additionally, block inbound access to the router's HTTP/HTTPS management ports from untrusted networks at any upstream firewall, and segment the device from sensitive internal hosts. The trade-off of disabling remote management is loss of off-network administration; ACL/VPN restriction preserves remote access at the cost of extra configuration. Monitor the VulDB entry (https://vuldb.com/vuln/391156) and ipTIME firmware channels for an eventual patched build, and replace the device if it is end-of-life and no fix appears.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is an EFM Networks ipTIME A3004T consumer/SOHO wireless router. The flaw sits in httpcon_check_session_url, a routine in the HTTP web administration daemon responsible for validating whether an incoming request URL is tied to an authenticated session. The root cause maps to CWE-287 (Improper Authentication): the session-URL check can be manipulated so the server treats an unauthenticated request as authorized, exposing privileged management endpoints. The single CPE, cpe:2.3:a:efm:iptime_a3004t, confirms the scope is this specific router model rather than the broader ipTIME line, though other models sharing the same web stack could plausibly be affected and should be verified.
Know when Iptime A3004T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote unauthenticated authentication bypass of the web management interface (AV:N/AC:L/PR:N/UI:N) yields full administrative control of the router, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical authentication bypass in EFM ipTIME A3004T routers (firmware 14.19.0) allows unauthenticated remote attackers to gain unrestricted access to the device's management interface, creating immediate risk for organizations depending on this equipment for network connectivity. With publicly available exploit code and no vendor-released patch despite notification, organizations must take urgent action to isolate, restrict access to, or replace affected devices to prevent network compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network segmentation to isolate management interfaces from untrusted networks; (2) firewall rules restricting management access to specific administrative IP addresses; (3) continuous monitoring for unauthorized access attempts to the management interface; (4) replacement with alternative router models from vendors with active security patch programs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB