CVE-2026-1740: EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication
A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpconchecksessionurl of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1740?
CVE-2026-1740 has been classified with a significant severity due to its potential for allowing unauthorized access through improper authentication.
How do I fix CVE-2026-1740?
To fix CVE-2026-1740, ensure that your EFM ipTIME A8004T device is updated to the latest firmware version provided by the vendor.
What is the impact of CVE-2026-1740?
CVE-2026-1740 could allow attackers to bypass authentication checks on the Hiddenloginsetup interface, compromising the device's security.
Which devices are affected by CVE-2026-1740?
CVE-2026-1740 specifically impacts the EFM ipTIME A8004T model running version 14.18.2.
What component of the EFM ipTIME A8004T is vulnerable in CVE-2026-1740?
The vulnerability in CVE-2026-1740 affects the function httpcon_check_session_url within the /cgi/timepro.cgi file.