Summary
generated automatically from NVD dataEFM ipTIME T16000M 14.20.2 contains an improper authentication flaw (CWE-287) in the function httpcon_check_session_url of its Session Validation Handler component. A remote attacker can manipulate this function to bypass authentication, and a public exploit is reported to be available. The vendor did not respond to the disclosure contact, and the flaw is rated CVSS 10.0 (CRITICAL, CVSS v3.1).
NVD description
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS · FIRST.org
1.5%probability of exploitation in the next 30 days
Higher than 73% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 24 août 2026
- Updated
- 12 oct. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-287
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.