Description

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-17T03:16:50.517Z",
  "pubdate": "2026-08-17T03:16:50.517Z",
  "executiveSummary": "An improper authentication vulnerability has been identified in the EFM ipTIME A3004T router running firmware version 14.19.0. The vulnerability resides within the Session Validation component, specifically inside the httpcon_check_session_url function. This flaw allows remote attackers to bypass authentication mechanisms entirely through targeted request manipulation.\nThe impact of this vulnerability is critical, as successful exploitation enables unauthorized remote actors to interact with the device management interface without supplying valid administrative credentials. Given that public exploit material is currently available and the vendor has failed to respond to early vulnerability disclosures, systems exposing their administrative interfaces to the network are at an elevated risk of compromise.\nThe attack vector is network-based, requiring no prior privileges or user interaction from the administrator, making automated scanning and widespread exploitation feasible. Organizations utilizing the affected product face severe risks, including unauthorized device reconfiguration, potential interception of network traffic, and secondary attacks launched from the compromised local network.",
  "technicalDetails": "The vulnerability is rooted in flawed session validation logic implemented within the httpcon_check_session_url function of the EFM ipTIME A3004T firmware version 14.19.0. This function is responsible for parsing incoming HTTP connection requests, inspecting URL parameters or session tokens, and determining whether the associated client session is authenticated.\nDue to improper handling of state validation and insufficient verification of cryptographic tokens or session identifiers within httpcon_check_session_url, the binary fails to reliably enforce authentication checks for restricted endpoints. An attacker can manipulate specific HTTP requests sent to the web management daemon, causing the session validation routine to incorrectly return a positive authentication status.\nThe exploitation lifecycle unfolds as follows: First, the remote attacker crafts an HTTP request targeting the administrative interface of the EFM ipTIME A3004T router. Rather than supplying a legitimate session cookie or authorization header, the payload leverages the structural weakness in httpcon_check_session_url by omitting or malforming validation tokens in a specific pattern. Upon receiving the crafted packet, the vulnerable function processes the request and incorrectly validates the unauthenticated state as legitimate. Consequently, the web server grants the attacker access to restricted administrative functionalities without requiring valid credentials.\nBecause the vulnerable component is exposed via the web management interface over the network, exploitation can occur remotely without authentication or privilege requirements. Post-exploitation impact includes full administrative control over the router, allowing attackers to modify system settings, alter DNS configurations, intercept traffic, or pivot deeper into the internal network."
}