EUVD-2026-64690
GHSA-r2qf-9984-83jj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated session bypass with full impact on the router; no scope change to downstream systems per 4.0 SC:N/SI:N/SA:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special non-default configuration is required - the Session Validation Handler is a core component of the router's HTTP management interface, which is enabled by default on ipTIME devices. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) accurately reflects a remotely exploitable, low-complexity authentication bypass requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a specially crafted HTTP request to the ipTIME T24000M management interface, manipulating the URL in a way that causes httpcon_check_session_url to incorrectly validate the session as authenticated. With authentication bypassed, the attacker gains full administrative control over the router - enabling DNS hijacking, credential harvesting of connected clients, or network traffic interception. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct immediate inventory of all EFM ipTIME T24000M devices in production, confirm firmware versions (14.20.0 and earlier are affected), and disable or isolate affected routers from direct internet exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today