This vulnerability affects the EFM ipTIME T16000M router firmware version 14.20.2. The issue lies in the httpcon_check_session_url function within the Session Validation Handler, which improperly validates sessions, leading to an authentication bypass. This allows remote attackers to gain unauthorized access without credentials. Public exploit code is available, increasing the risk of exploitation. The vendor was contacted but has not provided any response or remediation information.

Successful exploitation results in a complete bypass of authentication controls on the affected device, potentially allowing attackers to perform unauthorized actions remotely. Given the CVSS 4.0 base score of 10.0 (critical) with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability, the vulnerability poses a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the device's management interface to trusted hosts only as a temporary mitigation.