Critical Authentication Bypass in EFM ipTIME Router
A maximum-severity vulnerability has been disclosed in EFM Networks' ipTIME A3004T wireless router, a SOHO device widely deployed in South Korea and the Asia-Pacific region. The flaw, assigned CVE-2026-19977 with a CVSS score of 10.0, allows a remote unauthenticated attacker to completely bypass session authentication and gain full administrative control of the device.
Vulnerability Details
| Field | Details |
|---|---|
| CVE | CVE-2026-19977 |
| CVSS Score | 10.0 (Critical) |
| CWE | CWE-287 — Improper Authentication |
| Affected Product | EFM ipTIME A3004T firmware ≤ 14.19.0 |
| Attack Vector | Network (Remote) |
| Authentication Required | None |
| User Interaction | None |
| Complexity | Low |
Vulnerable Component
The flaw resides in the httpcon_check_session_url function within the Session Validation component of the router's embedded HTTP daemon. This function is responsible for verifying that incoming HTTP requests carry a valid efm_session_id cookie before granting access to administrative handlers.
The authentication logic contains a flaw whereby specific URL and parameter combinations cause the session state check to be skipped or incorrectly evaluated — the server treats a crafted unauthenticated request as if it had already passed authentication, without any login credentials being supplied.
Technical Analysis
The Authentication Bypass
The router's admin web interface processes requests through a central dispatcher. Authenticated access is enforced by httpcon_check_session_url, which checks the efm_session_id cookie before routing requests to protected handlers. The bypass works by crafting HTTP requests to specific URL patterns that cause this gate to be bypassed entirely:
/sess/checkSession
/cgi-bin/status
/status.html
/sess/checkSession?url=/cgi-bin/wandetect
Manipulating these URL patterns bypasses the httpcon_auth gate, granting direct access to administrative functions without any valid session token. A public proof-of-concept has been disclosed.
Shared Codebase Risk
This vulnerability is not isolated. Related CVEs CVE-2026-1740 and CVE-2026-1741 affect the sibling A8004T model running firmware 14.18.2 via the same httpcon_check_session_url function, indicating a shared codebase vulnerability across the ipTIME product line. This raises the possibility that other ipTIME models share the same vulnerable authentication logic.
Exploit Chain and Impact
Stage 1: Reconnaissance
└── Identify exposed ipTIME admin interface (port 80/443/8080)
Stage 2: Authentication Bypass
└── Send crafted HTTP request to vulnerable session URL
└── httpcon_check_session_url returns authenticated state
Stage 3: Full Administrative Access
├── DNS hijacking — redirect all LAN traffic
├── Backdoor implantation — persistent access
├── Rogue proxy configuration
├── Credential theft from connected devices
└── Lateral movement into internal networkIf the management interface is accessible from the WAN — via UPnP, port forwarding, or enabled remote management — the device is remotely exploitable with zero user interaction from a legitimate user.
Patch Status
No official patch or firmware update has been released. EFM Networks was contacted during responsible disclosure and did not respond. There is currently no vendor-provided mitigation.
Mitigations (No Patch Available)
Until a firmware update is released, apply these mitigations immediately:
- Disable WAN-side remote management — ensure the admin interface is not reachable from the internet
- Disable UPnP — prevents automatic port exposure
- Remove port-forwarding rules exposing ports 80, 443, or 8080 to the WAN
- Change the admin interface port from the default to a non-standard port (reduces scanning exposure)
- Segment the router management interface from general LAN access where possible
- Monitor DNS settings regularly — DNS hijacking is a primary post-exploitation goal
- Consider replacing the A3004T with a device from a vendor with active security support
Broader ipTIME Security Context
CVE-2026-19977 is part of a pattern of security issues across the ipTIME product line. A separate command injection vulnerability (CVE-2025-55423) affects 163 ipTIME models — including the A3004T — across firmware versions 12.10.2 to 14.19.4, where a controlURL value is passed unsanitized to system(). The concentration of critical flaws in session validation and input handling across multiple models underscores serious concerns about the security posture of the ipTIME firmware codebase.