Executive brief
The EFM ipTIME T24000M is a network router used to manage connectivity and provide remote support capabilities. A security flaw in the router's debug interface allows unauthenticated attackers to execute arbitrary commands with root-level privileges by exploiting a hardcoded authentication check and chaining multiple vulnerabilities together. This could enable complete device compromise, data interception, and network-wide attacks.
Technical details
The vulnerability is a remote command execution (RCE) flaw in the show_debug_screen function (mapped to d.cgi) of the router's web interface. The attack exploits an authentication bypass in the path-based access control (via /cgi/timepro.cgi), a hardcoded secret check that validates a specific string (!@dnjsrurelqjrm*&), and improper input validation in the command execution handler. An attacker must chain three steps: (1) bypass initial authentication checks using path manipulation, (2) reset the administrator password via a hidden "hiddenloginsetup" menu, (3) obtain a valid session, enable the remotesupport feature, and finally inject shell commands into the d.cgi endpoint. The vulnerability is network-accessible and requires no user interaction. Exploitation leads to arbitrary command execution as root, giving attackers full device control.
Affected products
- EFM Networks ipTIME T24000M up to 14.20.0
Timeline
- 2026-08-24: disclosed
- other: Exploit publicly disclosed on GitHub; vendor contacted but did not respond