Iptime T24000M
Monthly
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.