| 제목 | EFM ipTIME T16000M 14.20.2 Arbitrary Password Reset Due to Authentication Bypass |
|---|
| 설명 | A critical authentication bypass vulnerability exists in the core component `timepro.cgi` of the ipTIME T16000M (firmware version 14.20.2). This vulnerability stems from improper implementation of the session authentication logic. Specifically, the access control function `httpcon_check_session_url` determines whether to enable the authentication mechanism solely by checking whether the request URL begins with the prefix `/sess-bin/`.
Because this validation logic relies excessively on path-matching rules, the function incorrectly returns an unprotected state when the request path does not match the `/sess-bin/` rule. This causes the upstream `ftext` processing flow to bypass the call to `httpcon_auth`, thereby rendering the authentication mechanism completely ineffective.
An attacker need only modify the request path to `/cgi/timepro.cgi` to exploit this vulnerability and bypass the login requirement. The attacker can then target the hidden `hiddenloginsetup` interface and use the CAPTCHA token obtained via the unauthenticated request to force a reset of the administrator password.
By exploiting this authentication bypass vulnerability, an attacker can perform sensitive administrative operations—such as resetting the administrator password—even without a valid session binding.
Upon successful exploitation of this vulnerability, an attacker can gain unauthorized device management-level privileges and subsequently make arbitrary system configuration changes, including but not limited to disabling security features, tampering with network access control policies, and modifying the device’s operational configuration. |
|---|
| 원천 | ⚠️ https://github.com/AdminSafe/CVE/issues/3 |
|---|
| 사용자 | 010hex (UID 99386) |
|---|
| 제출 | 2026. 06. 30. PM 04:36 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 23. PM 04:08 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 394556 [EFM ipTIME T16000M 14.20.2 Session Validation httpcon_check_session_url 약한 인증] |
|---|
| 포인트들 | 0 |
|---|