提交 #874302: EFM ipTIME T16000M 14.20.2 Arbitrary Password Reset Due to Authentication Bypass

A critical authentication bypass vulnerability exists in the core component `timepro.cgi` of the ipTIME T16000M (firmware version 14.20.2). This vulnerability stems from improper implementation of the session authentication logic. Specifically, the access control function `httpcon_check_session_url` determines whether to enable the authentication mechanism solely by checking whether the request URL begins with the prefix `/sess-bin/`.

Because this validation logic relies excessively on path-matching rules, the function incorrectly returns an unprotected state when the request path does not match the `/sess-bin/` rule. This causes the upstream `ftext` processing flow to bypass the call to `httpcon_auth`, thereby rendering the authentication mechanism completely ineffective.

An attacker need only modify the request path to `/cgi/timepro.cgi` to exploit this vulnerability and bypass the login requirement. The attacker can then target the hidden `hiddenloginsetup` interface and use the CAPTCHA token obtained via the unauthenticated request to force a reset of the administrator password.

By exploiting this authentication bypass vulnerability, an attacker can perform sensitive administrative operations—such as resetting the administrator password—even without a valid session binding.

Upon successful exploitation of this vulnerability, an attacker can gain unauthorized device management-level privileges and subsequently make arbitrary system configuration changes, including but not limited to disabling security features, tampering with network access control policies, and modifying the device’s operational configuration.

• 来源: ⚠️ https://github.com/AdminSafe/CVE/issues/3
• 用户: 010hex (UID 99386)
• 提交: 2026-06-30 16時36分 (4 月前)
• 管理: 2026-08-23 16時08分 (2 months later)
• 状态: 重复
• VulDB条目: 394556 [EFM ipTIME T16000M 14.20.2 Session Validation httpcon_check_session_url 弱身份验证]
• 积分: 0