ipTIME T16000M EUVD-2026-64687

Exploitation requires network reachability to the HTTP session-validation handler (httpcon_check_session_url) of an ipTIME T16000M running firmware 14.20.2 - in practice, access to the router's web administration service, which is most impactful when the admin interface is exposed to the WAN and otherwise limited to attackers on the local/adjacent network. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed against the affected firmware. The principal limiting factor is exposure of the management interface: devices whose web admin is not reachable from the attacker's position are not exploitable, and only firmware 14.20.2 is confirmed affected.

The available signals are consistent and point to high real-world risk for exposed devices. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H, score 9.3) indicates a network-reachable, low-complexity, unauthenticated attack with total impact; the E:P (Proof-of-Concept) exploit-maturity metric aligns with the reported public exploit. No EPSS score and no SSVC decision data were provided, so exploitation probability and automatability cannot be quantified from this input. This CVE is not in CISA KEV, so there is no confirmed active exploitation - but publicly available exploit code combined with an unresponsive vendor and no patch materially raises the practical threat. The key limiting factor is exposure: consumer routers are most dangerous when the web admin interface is reachable from the WAN, so risk concentrates on internet-exposed or LAN-adjacent devices rather than being uniformly critical everywhere.

An attacker who can reach the router's web management interface - for example an internet-exposed device or an attacker on the local network - sends crafted HTTP requests that the httpcon_check_session_url routine wrongly treats as an authenticated session, bypassing login. With public exploit code available, the attacker gains administrative control and can alter configuration, DNS, or firewall settings to intercept or redirect traffic. Given AV:N/AC:L/PR:N/UI:N, this requires no credentials, no user interaction, and only low complexity.