4
CVEs
2
Critical
1
High
0
KEV
4
PoC
3
Unpatched C/H
0.0%
Patch Rate
1.1%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78167 | Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix. | CRITICAL | 9.3 | 1.0% | 68 |
PoC
No patch
|
| CVE-2026-19977 | Authentication bypass in EFM ipTIME A3004T (firmware 14.19.0) lets remote attackers defeat session validation through the httpcon_check_session_url function, granting unauthorized access to the router's web management interface. Publicly available exploit code exists, though the flaw is not yet listed in CISA KEV. The vendor was notified but did not respond, so no fix is currently available. | CRITICAL | 9.3 | 0.7% | 67 |
PoC
No patch
|
| CVE-2026-78168 | Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-19379 | OS command injection in EFM ipTIME AX8004M firmware 15.09.0 exposes routers to unauthenticated remote code execution via the `fname` parameter of the `/cgi/d.cgi` CGI endpoint, where unsanitized input is passed directly to the `popen()` function. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path for affected devices. Despite a CVSS 4.0 score of 6.9 (Medium) with limited impact metrics, the combination of no-authentication network access, arbitrary OS command execution capability, and an available PoC represents materially higher practical risk than the score reflects - no public exploit identified at time of analysis is explicitly not applicable here, as publicly available exploit code exists. | MEDIUM | 5.5 | 1.7% | 49 |
PoC
No patch
|