Submit #877920: EFM ipTIME A3004T Version 14.20.8 and earlier Authentication Bypass and Arbitrary File Upload

There is a critical security vulnerability in the ipTIME router firmware involving the timepro.cgi binary file.
First, the ftext scheduler in the timepro.cgi binary file contains an authentication bypass flaw when processing URL paths: an attacker can bypass session authentication logic by replacing the standard /sess-bin/ path prefix with /cgi/, thereby gaining direct access to sensitive CGI functions that would otherwise require authentication.
Second, the `commit_vpncli_file_upload` function lacks an effective file validation mechanism and does not perform validity checks on the file extensions or contents of uploaded files, allowing an attacker to upload arbitrary files to the system directory `/etc/econf/vpnclient/openvpn/`.
An attacker can bypass authentication to call this function and upload a malicious OpenVPN configuration file containing the `script-security 2` directive or higher. When the system calls the VPN service to load this configuration, the OpenVPN process will execute the malicious script in the configuration file with root privileges, ultimately enabling unauthenticated remote root-level arbitrary command execution.

• Source: ⚠️ https://github.com/AdminSafe/CVE/issues/4
• User: 010hex (UID 99386)
• Submission: 07/02/2026 13:51 (2 months ago)
• Moderation: 08/23/2026 16:09 (2 months later)
• Status: Duplicate
• VulDB entry: 391156 [EFM ipTIME A3004T 14.19.0 Session Validation httpcon_check_session_url improper authentication]
• Points: 0