| शीर्षक | EFM ipTIME T24000M Version 14.20.0 and earlier Remote Code Execution (RCE) |
|---|
| विवरण | The ipTIME T24000M firmware (version 14.20.0 and earlier) contains a critical chain of vulnerabilities that allows unauthenticated remote root users to gain privileges.
The vulnerability stems from a logical flaw in the session validation mechanism of the core `timepro.cgi` binary. The access control function `httpcon_check_session_url` incorrectly skips authentication checks for HTTP requests whose URL paths do not begin with `/sess-bin/`; an attacker need only modify the request path to `/cgi/timepro.cgi` to bypass the login requirement.
This bypass enables an attacker to gain unauthorized access to the restricted `hiddenloginsetup` function, thereby forcing a reset of the administrator password to satisfy the security checks of a secondary vulnerability.
Subsequently, by enabling the “Remote Support” feature and using a hardcoded magic string (!@dnjsrurelqjrm*&) to access the hidden d.cgi debug endpoint, an attacker can bypass the final layer of security and directly inject arbitrary shell commands into the popen system call via the cmd parameter, ultimately gaining full root privileges. |
|---|
| स्रोत | ⚠️ https://github.com/AdminSafe/CVE/issues/10 |
|---|
| उपयोगकर्ता | 010hex (UID 99386) |
|---|
| सबमिशन | 09/07/2026 04:46 AM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 04:09 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394557 [EFM ipTIME T24000M तक 14.20.0 Session Validation httpcon_check_session_url कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|