The vulnerability CVE-2026-19977 affects EFM ipTIME A3004T version 14.19.0. It arises from improper authentication handling in the httpcon_check_session_url function within the session validation component. This flaw allows remote attackers to manipulate the session validation process to bypass authentication controls. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, scope, and security requirements. The exploit is publicly available, but the vendor has not issued any response or patch.

Successful exploitation enables remote attackers to bypass authentication mechanisms on the affected device, potentially granting unauthorized access to administrative functions. This can lead to full compromise of the device, impacting confidentiality, integrity, and availability. Given the critical CVSS score and public exploit availability, the risk is high.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider mitigating exposure by restricting network access to the affected device, using network segmentation, or replacing the device if possible. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.