CVE Intelligence
Analysis AI-assisted

CVE-2026-1740: EFM ipTIME A8004T Firmware Improper Authentication in Session Check

CVE-2026-1740 describes an improper authentication flaw (CWE-287) in the EFM ipTIME A8004T firmware version 14.18.2, located in the session check function of /cgi/timepro.cgi. NVD rates it Critical with CVSS 3.1 score 9.8, and the record states the exploit has been made public. The CISA KEV catalog does not list it, and the vendor did not respond to early disclosure, so no fix is listed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A vulnerability classified as CWE-287 (Improper Authentication) was reported in the EFM ipTIME A8004T firmware version 14.18.2. The flaw is in the function httpcon_check_session_url of /cgi/timepro.cgi, within a component described as Hidden Hiddenloginsetup Interface. The record states the issue can be triggered remotely and that the exploit has been made public.

Impact

Improper authentication may allow a remote party to bypass the expected access control of the affected device. NVD scores the issue Critical (CVSS 3.1, 9.8) with high confidentiality, integrity and availability impact in the vector. The concrete consequences depend on the device configuration and are not described in the record.

Affected products and versions

  • Product listed: Iptime A8004t Firmware
  • Version listed: 14.18.2
  • No other versions are listed in the record. The sources consulted do not confirm whether other builds are affected.

Exploitation status

  • The CISA KEV catalog does not list this CVE, so no active exploitation is confirmed in the sources consulted.
  • The record states that the exploit has been made public. Public availability raises the risk of opportunistic use, but the record does not show observed attacks.

Remediation and mitigation

  • No fixed version is listed. The absence of a listed fix does not confirm that none exists, so check the vendor and the references for updates.
  • The vendor reportedly did not respond to early disclosure, so an official patch may not be available.
  • Restrict access to the device administration interface to trusted internal networks, disable remote management where it is not needed, and block untrusted access to the web interface at the perimeter.
  • If no vendor fix is released, consider replacing or isolating the device according to the organization risk assessment.

Detection guidance

  • Review device and web server logs for requests to administrative CGI paths from unexpected sources or unusual session activity.
  • Monitor for unexpected configuration changes or new administrative sessions on ipTIME A8004T devices.
  • Maintain an inventory of these devices to confirm firmware version and network exposure.

Limitations of the available information

  • The record provides no fixed version, no vendor advisory, and no EPSS or SSVC data.
  • CVSS scores differ by source: NVD 3.1 gives 9.8, while the CNA entries list 5.5 (version 4.0), 7.3 (version 3.1) and 7.5 (version 2.0).
  • The record contains no technical reproduction details, and this analysis does not add any.

Frequently asked questions

Is CVE-2026-1740 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, so no active exploitation is confirmed in the sources consulted. The record does state that the exploit has been made public.

Is there a fix for CVE-2026-1740?

No fixed version is listed in the record, and the vendor reportedly did not respond to disclosure. Restrict access to the device interface and monitor the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.