CVE-2026-78168 is a remote authentication bypass vulnerability in EFM ipTIME T24000M devices up to firmware version 14.20.0. The issue resides in the httpcon_check_session_url function of the Session Validation Handler, allowing attackers to manipulate session validation and bypass authentication controls. This vulnerability is remotely exploitable without requiring privileges or user interaction. The vulnerability has been publicly disclosed, but the vendor has not issued a response or patch. The CVSS v3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication mechanisms, potentially gaining unauthorized access to the device. This can lead to full compromise of the device's confidentiality, integrity, and availability. Given the high CVSS score (9.8), the impact is critical, enabling attackers to control or disrupt the affected device.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is provided, restricting network access to the device and applying network-level controls to limit exposure may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.