CVE-2026-1740 is a high severity (CVSS 7.3) improper authentication flaw in the EFM ipTIME A8004T router, firmware 14.18.2. A hidden login setup interface can be reached remotely. The record says an exploit is public and the vendor did not reply, so we found no fix. Limit management access.
What's affected
EFM ipTIME A8004T, firmware version 14.18.2. The record points to the function httpcon_check_session_url in /cgi/timepro.cgi, in a component it calls the Hidden Hiddenloginsetup Interface.
The record says the exploit has been made public, and that the vendor was contacted early about the disclosure but did not respond. We found no patched firmware in the pages we reached. Check ipTIME's download page for newer firmware for your model.
How to check if you're exposed
Log in to the router's administration page and read the firmware version in the system information screen. Version 14.18.2 on an A8004T is the one named in the record.
Next, check whether the management interface is reachable from the internet. Many home and small office routers can expose their web interface on the WAN side. Test from outside your network, or check the remote management setting on the router. Also review the list of devices and settings for changes you did not make.
What to do now
- Identify A8004T routers and their firmware versions.
- Turn off remote management from the internet, and limit the admin interface to a trusted address on the local network.
- Check ipTIME for newer firmware and install it if a version is available.
- Change the admin password and review the router settings, including DNS servers and port forwards.
- If no fix appears, plan to replace the device.
Why it matters
The weakness is CWE-287 (Improper Authentication). The session check on a hidden setup page did not properly confirm who the caller was, so a request could reach functions that need a signed-in administrator. The title of the public report mentions an authentication bypass and password reset, but we have not independently verified its details.
A router sits at the edge of a network, and whoever controls its settings can redirect traffic. With no vendor response on record, reducing exposure is the practical step. CISA does not list this CVE as known exploited, though the record says an exploit is public.
Quick check
Is there a firmware update?
We could not confirm one. The record says the vendor did not respond, so check the ipTIME download page for your model.
Sources
Last reviewed: 19 October 2026.
