CVE-2026-19977CVSS 10.0 Critical2026-08-17
EFM ipTIME A3004T Session Validation Manipulation Leading to Authentication Bypass
In EFM ipTIME A3004T version 14.19.0, the httpcon_check_session_url function in the Session Validation component contains an improper authentication (CWE-287) security flaw. By manipulating this function in a specific way, an attacker can cause improper authentication and bypass the normal authentication flow. The vulnerability allows a remote attacker to access protected resources without credentials, and exploit code is now public. The vendor was contacted early in the disclosure process but did not respond, and no official patch is available. The vulnerability affects all EFM ipTIME A3004T devices running version 14.19.0. An attacker can launch the attack remotely and achieve unauthorized access with no user interaction.
Component
The EFM ipTIME A3004T is a network access device providing connectivity and session management, widely used in home and small business network environments.
Risks
- Complete system control: An attacker can bypass authentication to obtain device administration privileges directly, then execute arbitrary commands, modify configuration or install malicious software
- No user interaction required: An attacker only needs to send a crafted request remotely over the network; no click or interaction from the target user is required
- Data disclosure and tampering: With authentication bypassed, an attacker can steal sensitive network data or tamper with network configuration, causing service disruption or man-in-the-middle attacks
Source
Remediation- Restrict access to the device management interface at the firewall or gateway level, allowing only trusted IP addresses
- Monitor network traffic for anomalous request patterns targeting httpcon_check_session_url and block suspicious connections promptly
Package Poisoningnpm2026-08-17
@junofficial/baileys@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
8331b1360c3efa263e03409fe98ff316
Package Poisoningnpm2026-08-17
@siwatfa/yorn@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
ec587381f2d9c368a4e2a719e75c302b
Package Poisoningnpm2026-08-17
a.poltoradnev-package-a@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
2253c25c2785dce7156fc038894747be
Package Poisoningnpm2026-08-17
autoai@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
d9c87e80d2e4b37c192a19d503187991
Package Poisoningnpm2026-08-17
cloud-agen-bot@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
0ddc8dd51956cc840df3b398f420e4ef
Package Poisoningnpm2026-08-17
club-sauce@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
8cf242c8f043c9099a5b5487d72860f6
Package Poisoningnpm2026-08-17
junofficial-userbot@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
e699ead5bb2060d48e9dfe484e9f5441
Package Poisoningnpm2026-08-17
sugarball-cli@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
847b55c4c17f14f115011ddf423a16ab
Package Poisoningnpm2026-08-17
userbotjs@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
6e0bc32ef9a59f86f9c40aa526c48c18
Package Poisoningnpm2026-08-17
userbotjs-jun@>= 0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
226fd7c4feb33de92ec0945aa0d2a1e4
