| タイトル | ipTIME T24000M Version 14.20.0 and earlier Authentication Bypass and Arbitrary Password Reset |
|---|
| 説明 | An authentication bypass vulnerability exists in the web management interface of the ipTIME T24000M router running firmware 14.20.0 and earlier. The access-control routine httpcon_check_session_url determines whether mandatory authentication is enforced solely by checking whether the request path begins with the /sess-bin/ prefix. When a request path does not satisfy this rule, the function returns 0, causing the upstream ftext handler to skip the call to httpcon_auth, so the authentication check is never executed for requests handled by timepro.cgi. As a result, an unauthenticated attacker who can reach the web management interface (TCP port 80, LAN-side by default, or WAN-side if remote administration is enabled) can reset the administrator credentials: the attacker first obtains a valid CAPTCHA token via GET /sess-bin/captcha.cgi, then sends a crafted unauthenticated POST request to the timepro.cgi endpoint with the parameters act=save&tmenu=iframe&smenu=hiddenloginsetup&captcha_file=<token>&captcha_code=<code>&new_passwd=<attacker-controlled>&new_login=<attacker-controlled>. The server processes this request as a trusted administrative operation and immediately changes the administrator account name and password, allowing the attacker to log in with the new credentials and obtain full control of the device, enabling further attacks such as DNS hijacking, malicious configuration changes, or denial of service against legitimate administrators. |
|---|
| ソース | ⚠️ https://github.com/AdminSafe/CVE/issues/11 |
|---|
| ユーザー | 010hex (UID 99386) |
|---|
| 送信 | 2026年08月24日 12:43 (1 月 ago) |
|---|
| モデレーション | 2026年09月19日 12:35 (26 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 394557 [EFM ipTIME T24000M 迄 14.20.0 Session Validation httpcon_check_session_url 弱い認証] |
|---|
| ポイント | 0 |
|---|