CVE-2026-1740
Published: 02 February 2026
Summary
CVE-2026-1740 is a medium-severity Improper Authentication (CWE-287) vulnerability in Iptime A8004T Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2026-1740 is an improper authentication vulnerability (CWE-287) in the EFM ipTIME A8004T router firmware version 14.18.2. It affects the httpcon_check_session_url function in the /cgi/timepro.cgi file of the Hidden Hiddenloginsetup Interface component.
The vulnerability enables remote exploitation by unauthenticated attackers (AV:N/AC:L/PR:N/UI:N) with low complexity and no user interaction required. Successful attacks result in limited impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), earning a CVSS v3.1 base score of 7.3. A public exploit is available and could be used.
Advisories referenced on VulDB (ctiid.343639, id.343639, submit.741422) and a GitHub issue detail the issue, noting that the vendor was contacted early for disclosure but provided no response. No patches or official mitigations are mentioned.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5126
Vulnerability details
A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has…
more
been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an improper authentication flaw in a public-facing router web interface (/cgi/timepro.cgi), enabling unauthenticated remote exploitation (AV:N/AC:L/PR:N/UI:N), directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and remediation of the improper authentication flaw in the httpcon_check_session_url function of the router firmware.
Enforces approved authorizations for access to system resources, directly addressing the authentication bypass in the hidden loginsetup interface CGI script.
Mandates identification and authentication for organizational users, preventing remote unauthenticated exploitation of the vulnerable session check mechanism.