EUVD-2026-64687
GHSA-2hpc-g37m-pmw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated auth bypass of the router web admin grants full administrative control, so PR:N/UI:N with high C/I/A; scope unchanged as impact stays within the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the HTTP session-validation handler (httpcon_check_session_url) of an ipTIME T16000M running firmware 14.20.2 - in practice, access to the router's web administration service, which is most impactful when the admin interface is exposed to the WAN and otherwise limited to attackers on the local/adjacent network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The available signals are consistent and point to high real-world risk for exposed devices. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the router's web management interface - for example an internet-exposed device or an attacker on the local network - sends crafted HTTP requests that the httpcon_check_session_url routine wrongly treats as an authenticated session, bypassing login. With public exploit code available, the attacker gains administrative control and can alter configuration, DNS, or firewall settings to intercept or redirect traffic. … |
| Remediation | No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, so no fixed firmware version can be cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct network inventory to identify all EFM ipTIME T16000M devices in production and immediately restrict management interface (TCP 80/443) access to trusted administrative networks via perimeter firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today