| Title | ipTIME T24000M Version 14.20.0 and earlier Authentication Bypass and Arbitrary Password Reset |
|---|
| Description | An authentication bypass vulnerability exists in the web management interface of the ipTIME T24000M router running firmware 14.20.0 and earlier. The access-control routine httpcon_check_session_url determines whether mandatory authentication is enforced solely by checking whether the request path begins with the /sess-bin/ prefix. When a request path does not satisfy this rule, the function returns 0, causing the upstream ftext handler to skip the call to httpcon_auth, so the authentication check is never executed for requests handled by timepro.cgi. As a result, an unauthenticated attacker who can reach the web management interface (TCP port 80, LAN-side by default, or WAN-side if remote administration is enabled) can reset the administrator credentials: the attacker first obtains a valid CAPTCHA token via GET /sess-bin/captcha.cgi, then sends a crafted unauthenticated POST request to the timepro.cgi endpoint with the parameters act=save&tmenu=iframe&smenu=hiddenloginsetup&captcha_file=<token>&captcha_code=<code>&new_passwd=<attacker-controlled>&new_login=<attacker-controlled>. The server processes this request as a trusted administrative operation and immediately changes the administrator account name and password, allowing the attacker to log in with the new credentials and obtain full control of the device, enabling further attacks such as DNS hijacking, malicious configuration changes, or denial of service against legitimate administrators. |
|---|
| Source | ⚠️ https://github.com/AdminSafe/CVE/issues/11 |
|---|
| User | 010hex (UID 99386) |
|---|
| Submission | 08/24/2026 12:43 (27 days ago) |
|---|
| Moderation | 09/19/2026 12:35 (26 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 394557 [EFM ipTIME T24000M up to 14.20.0 Session Validation httpcon_check_session_url improper authentication] |
|---|
| Points | 0 |
|---|