CVE-2026-78167: Improper Authentication in EFM ipTIME T16000M

This vulnerability involves improper authentication in the httpcon_check_session_url function of the Session Validation Handler in EFM ipTIME T16000M firmware version 14.20.2. The weakness allows remote attackers to bypass authentication controls, potentially gaining unauthorized access. Exploit code has been publicly released. The vendor was notified but has not issued any response or remediation guidance. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to bypass authentication mechanisms on the affected device, potentially leading to unauthorized access and control over the router. This could compromise device confidentiality, integrity, and availability. Given the critical CVSS score and public exploit availability, the risk of attack is significant.

No official patch or remediation guidance is currently available from the vendor. Users should monitor for vendor updates and consider mitigating exposure by restricting network access to the device's management interface until a fix is released.