by Kastro
Paper/Archive/CVE-2026-19977

CVE-2026-19977

EFM ipTIME A3004T — EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication

EPSS 1%public exploitCVSS 10.0
critical.is priorityof 100
54
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 71.1.711 × 2014.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource
ipTIME A3004T14.19.0–CNA

Scores by source

VulDB (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
VulDB (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/vuln/391156refvuldb.com/vuln/391156/ctiwriteupvuldb.com/cve/CVE-2026-19977writeupvuldb.com/submit/873848exploitgithub.com/AdminSafe/CVE/issues/1