---
id: CVE-2026-78167
title: A weakness has been identified in EFM ipTIME T16000M 14.20.2
summary: >-
  A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted
  element is the function httpcon_check_session_url of the component Session
  Validation Handler. This manipulation causes improper authentication. Remote
  exploitati…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-287
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78167'
references:
  - url: 'https://github.com/AdminSafe/CVE/issues/2'
    label: cna@vuldb.com
  - url: 'https://github.com/AdminSafe/CVE/issues/3'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-78167'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/874154'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/874302'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/394556'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/394556/cti'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.01478
epssPercentile: 0.73184
ingestedAt: '2026-10-12T16:57:59.900Z'
---

## Overview

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.