ipTIME T24000M CVE-2026-78168

No special non-default configuration is required - the Session Validation Handler is a core component of the router's HTTP management interface, which is enabled by default on ipTIME devices. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-accessible, unauthenticated remote exploitation with no attack complexity or specific preconditions. The primary limiting factor is network reachability: if the management interface is restricted to LAN-only access, exploitation is limited to attackers with local network access. Exploitation is further constrained to devices running firmware 14.20.0 or earlier - devices already updated beyond this version (if a future patch is released) would not be affected. No user interaction, elevated privilege, or specific protocol negotiation is required beyond HTTP access to the management port.

The CVSS 4.0 score of 8.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately reflects a remotely exploitable, low-complexity authentication bypass requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact on the vulnerable system. The E:P exploit maturity modifier is confirmed by a public proof-of-concept on GitHub, significantly compressing the exploitation window relative to theoretical-only vulnerabilities. The absence of a CISA KEV listing indicates no confirmed widespread threat actor exploitation at time of analysis, but authentication bypass flaws on network devices with public POCs have historically been rapidly weaponized, making this a high-urgency issue for any organization running affected ipTIME hardware. The vendor's failure to respond to disclosure eliminates the possibility of an official fix in the near term, forcing defenders to rely entirely on compensating controls. EPSS data was not provided in the input; the KEV absence should not be interpreted as low real-world risk given the exploit availability and vendor non-response.

An unauthenticated remote attacker sends a specially crafted HTTP request to the ipTIME T24000M management interface, manipulating the URL in a way that causes httpcon_check_session_url to incorrectly validate the session as authenticated. With authentication bypassed, the attacker gains full administrative control over the router - enabling DNS hijacking, credential harvesting of connected clients, or network traffic interception. A public proof-of-concept is available on GitHub, reducing the skill threshold for exploitation significantly.