CVE-2026-19977CWE-287

CVE-2026-19977

Critical · published August 17, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.01333 · 70.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-17T07:16Z
References (5)
https://vuldb.com/vuln/391156 · [email protected]https://vuldb.com/vuln/391156/cti · [email protected]https://github.com/AdminSafe/CVE/issues/1 · [email protected]https://vuldb.com/cve/CVE-2026-19977 · [email protected]https://vuldb.com/submit/873848 · [email protected]
EPSS history
Timeline
  • 17 AUG 03:00Z
    EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
    cvelistv5