A vulnerability in the firmware of ipTIME routers permits an unauthenticated attacker to bypass standard authentication mechanisms and retrieve sensitive information stored on the device. The weakness corresponds to CWE‑200, focusing on exposing private data. The vulnerability does not grant execution privileges, but it allows read access to configuration, user database, or other confidential information, potentially enabling further manipulation of device settings or network traffic.

The affected devices include all EFM‑Networks, Inc. ipTIME models: the ax2004m, ax3000q, ax6000m, and t5008. Firmware versions through 15.26.8 are impacted. Users of these routers should verify their firmware version and ensure it is at least 15.26.9 or later to mitigate the issue.

The CVSS score of 6 indicates a moderate severity, reflecting the combination of authentication bypass and data disclosure. EPSS shows an exploitation probability of less than 1 %, implying that while the vulnerability exists, it is unlikely to be widely targeted. The vulnerability is not listed in the CISA KEV catalog. Attackers typically need to be within the local network or have a path to the router’s management interface; precise exploitation details are not provided, so the presumed attack vector is internal or adjacent network access, with the attacker leveraging the weak authentication check to read information.