The vulnerability CVE-2026-19977 affects EFM ipTIME A3004T firmware version 14.19.0. It arises from improper authentication in the httpcon_check_session_url function within the session validation component. This flaw enables remote attackers to manipulate session validation and bypass authentication controls. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. Exploit code is publicly available, but the vendor has not issued any patch or official remediation.

Successful exploitation allows remote attackers to bypass authentication on the affected device, potentially gaining unauthorized access to administrative functions or sensitive information. This can lead to full compromise of the device and network security. The vulnerability's critical CVSS score reflects the high impact and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting network access to the device's management interface, disabling remote management if enabled, and monitoring for suspicious activity. Stay alert for any future vendor advisories or patches.