Gửi #874154: EFM ipTIME T16000M 14.20.2 Remote Code Execution (RCE)

A critical chain of vulnerabilities allowing unauthorized remote root privilege escalation exists in firmware version 14.20.2 of the ipTIME T16000M router. The root cause of this vulnerability chain lies in a logic flaw in the session validation function `httpcon_check_session_url` within the core web management component `timepro.cgi`: When processing HTTP requests, this function incorrectly skips authentication checks for URL paths that do not begin with `/sess-bin/`. As a result, an attacker need only modify the request path to `/cgi/timepro.cgi` to completely bypass login authentication and access the device’s backend functions with unauthorized privileges. By exploiting this authentication bypass, an attacker can directly invoke the restricted `hiddenloginsetup` interface to force a reset of the device administrator’s password, thereby satisfying the permission requirements for subsequent attack steps. After obtaining valid administrator credentials, the attacker further enables the device’s “Remote Support” feature, thereby gaining access to the hidden debug endpoint /sess-bin/d.cgi, which is protected by a hard-coded magic string: !@dnjsrurelqjrm*&. Upon successful authentication, the attacker can use the `cmd` parameter to directly inject arbitrary shell commands into the `popen` system call for execution, ultimately gaining full root privileges on the device. The entire exploit chain—from penetration from an external network to full control of the device—requires no user interaction or prior authentication, posing a serious threat to network environments deploying this router model.

• Nguồn: ⚠️ https://github.com/AdminSafe/CVE/issues/2
• Người dùng: 010hex (UID 99386)
• Đệ trình: 30/06/2026 13:26 (cách đây 2 các tháng)
• Kiểm duyệt: 23/08/2026 16:08 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 394556 [EFM ipTIME T16000M 14.20.2 Session Validation httpcon_check_session_url xác thực yếu]
• điểm: 20