提出 #874302: EFM ipTIME T16000M 14.20.2 Arbitrary Password Reset Due to Authentication Bypass

A critical authentication bypass vulnerability exists in the core component `timepro.cgi` of the ipTIME T16000M (firmware version 14.20.2). This vulnerability stems from improper implementation of the session authentication logic. Specifically, the access control function `httpcon_check_session_url` determines whether to enable the authentication mechanism solely by checking whether the request URL begins with the prefix `/sess-bin/`.

Because this validation logic relies excessively on path-matching rules, the function incorrectly returns an unprotected state when the request path does not match the `/sess-bin/` rule. This causes the upstream `ftext` processing flow to bypass the call to `httpcon_auth`, thereby rendering the authentication mechanism completely ineffective.

An attacker need only modify the request path to `/cgi/timepro.cgi` to exploit this vulnerability and bypass the login requirement. The attacker can then target the hidden `hiddenloginsetup` interface and use the CAPTCHA token obtained via the unauthenticated request to force a reset of the administrator password.

By exploiting this authentication bypass vulnerability, an attacker can perform sensitive administrative operations—such as resetting the administrator password—even without a valid session binding.

Upon successful exploitation of this vulnerability, an attacker can gain unauthorized device management-level privileges and subsequently make arbitrary system configuration changes, including but not limited to disabling security features, tampering with network access control policies, and modifying the device’s operational configuration.

• ソース: ⚠️ https://github.com/AdminSafe/CVE/issues/3
• ユーザー: 010hex (UID 99386)
• 送信: 2026年06月30日 16:36 (3 月 ago)
• モデレーション: 2026年08月23日 16:08 (2 months later)
• ステータス: 重複
• VulDBエントリ: 394556 [EFM ipTIME T16000M 14.20.2 Session Validation httpcon_check_session_url 弱い認証]
• ポイント: 0