| Titolo | EFM ipTIME T16000M 14.20.2 Arbitrary Password Reset Due to Authentication Bypass |
|---|
| Descrizione | A critical authentication bypass vulnerability exists in the core component `timepro.cgi` of the ipTIME T16000M (firmware version 14.20.2). This vulnerability stems from improper implementation of the session authentication logic. Specifically, the access control function `httpcon_check_session_url` determines whether to enable the authentication mechanism solely by checking whether the request URL begins with the prefix `/sess-bin/`.
Because this validation logic relies excessively on path-matching rules, the function incorrectly returns an unprotected state when the request path does not match the `/sess-bin/` rule. This causes the upstream `ftext` processing flow to bypass the call to `httpcon_auth`, thereby rendering the authentication mechanism completely ineffective.
An attacker need only modify the request path to `/cgi/timepro.cgi` to exploit this vulnerability and bypass the login requirement. The attacker can then target the hidden `hiddenloginsetup` interface and use the CAPTCHA token obtained via the unauthenticated request to force a reset of the administrator password.
By exploiting this authentication bypass vulnerability, an attacker can perform sensitive administrative operations—such as resetting the administrator password—even without a valid session binding.
Upon successful exploitation of this vulnerability, an attacker can gain unauthorized device management-level privileges and subsequently make arbitrary system configuration changes, including but not limited to disabling security features, tampering with network access control policies, and modifying the device’s operational configuration. |
|---|
| Fonte | ⚠️ https://github.com/AdminSafe/CVE/issues/3 |
|---|
| Utente | 010hex (UID 99386) |
|---|
| Sottomissione | 30/06/2026 16:36 (3 mesi fa) |
|---|
| Moderazione | 23/08/2026 16:08 (2 months later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 394556 [EFM ipTIME T16000M 14.20.2 Session Validation httpcon_check_session_url autenticazione debole] |
|---|
| Punti | 0 |
|---|