{"id":"CVE-2026-19977","state":"PUBLISHED","title":"EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication","description":"A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-08-17T03:00:09.815Z","updatedAt":"2026-08-18T14:18:47.983Z","severity":{"score":10,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","source":"VulDB"},"assigner":"VulDB","products":["EFM ipTIME A3004T"],"affected":[{"vendor":"EFM","product":"ipTIME A3004T","versions":[{"version":"14.19.0","status":"affected"}],"cpes":["cpe:2.3:a:efm:iptime_a3004t:*:*:*:*:*:*:*:*"],"modules":["Session Validation"]}],"references":["https://vuldb.com/vuln/391156","https://vuldb.com/vuln/391156/cti","https://vuldb.com/cve/CVE-2026-19977","https://vuldb.com/submit/873848","https://github.com/AdminSafe/CVE/issues/1"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19977.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19977","state":"PUBLISHED","datePublished":"2026-08-17T03:00:09.815Z","dateUpdated":"2026-08-18T14:18:47.983Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-16T12:06:43.611Z"},"containers":{"cna":{"title":"EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication","descriptions":[{"lang":"en","value":"A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"EFM","product":"ipTIME A3004T","versions":[{"version":"14.19.0","status":"affected"}],"cpes":["cpe:2.3:a:efm:iptime_a3004t:*:*:*:*:*:*:*:*"],"modules":["Session Validation"]}],"references":[{"url":"https://vuldb.com/vuln/391156","name":"VDB-391156 | EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/391156/cti","name":"VDB-391156 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19977","name":"CVE-2026-19977 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/873848","name":"Submit #873848 | iptime A3004T 14.19.0 Authentication bypass and arbitrary password reset vulnerabiliti","tags":["third-party-advisory"]},{"url":"https://github.com/AdminSafe/CVE/issues/1","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":10,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","baseSeverity":"CRITICAL"}},{"cvssV3_1":{"version":"3.1","baseScore":10,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"CRITICAL"}},{"cvssV3_0":{"version":"3.0","baseScore":10,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","baseSeverity":"CRITICAL"}},{"cvssV2_0":{"version":"2.0","baseScore":10,"vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-17T03:00:09.815Z"},"timeline":[{"time":"2026-08-16T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-16T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-16T14:11:51.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"010hex (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-18T14:18:32.059640Z","id":"CVE-2026-19977","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-18T14:18:47.983Z"}}]}}}