CVE-2026-78167Broken Authentication in EFM ipTIME T16000M Router
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
View on NVDAnalysis
El router EFM ipTIME T16000M presenta una vulnerabilidad crítica que permite a atacantes remotos evadir la autenticación y tomar control del dispositivo de forma remota. Existe un exploit público disponible para esta falla y el fabricante no ha emitido parches ni comentarios al respecto. Es fundamental revisar si este hardware forma parte de tu infraestructura de red para mitigar posibles accesos no autorizados.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-287EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.