CVE-2026-19977
EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
- State
- Published
- Severity
- 10.0 Critical
- Published
- Aug 17, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 16, 2026
Description
A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 10.0 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 10.0 High | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
ipTIME A3004TEFM |
|
References
- VDB-391156 | EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authenticationvdb-entrytechnical-description
- VDB-391156 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-19977 | CVE Analysis and Reportthird-party-advisory
- Submit #873848 | iptime A3004T 14.19.0 Authentication bypass and arbitrary password reset vulnerabilitithird-party-advisory
- https://github.com/AdminSafe/CVE/issues/1exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.