CVE-2026-78167
CriticalCVSS 10.0Summary
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the httpcon_check_session_url function of the Session Validation Handler component. This manipulation causes improper authentication. Remote exploitation is possible, and the exploit is public. The vendor did not respond.
Risk Assessment
A remote attacker can bypass authentication and gain access to the device, potentially compromising network data integrity and confidentiality.
Recommendation
Monitor for vendor patches; meanwhile, restrict device access to trusted networks and apply additional protection mechanisms.
Original NVD description (English source)
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.