What’s Vulnerable › Vulnerabilities

CVE-2026-24498

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-200

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc. IpTIME T5008, EFM-Networks, Inc. IpTIME AX2004M, EFM-Networks, Inc. IpTIME AX3000Q, EFM-Networks, Inc. IpTIME AX6000M allows Authentication Bypass.This issue affects ipTIME T5008: through 15.26.8; ipTIME AX2004M: through 15.26.8; ipTIME AX3000Q: through 15.26.8; ipTIME AX6000M: through 15.26.8.

Affected products

• Iptime Ax2004M Firmware: before 15.27.2 — fixed in 15.27.2
• Iptime Ax3000Q Firmware: before 15.27.2 — fixed in 15.27.2
• Iptime Ax6000M Firmware: before 15.27.2 — fixed in 15.27.2
• Iptime T5008 Firmware: before 15.27.2 — fixed in 15.27.2

How to fix

Upgrade to a fixed version: Iptime Ax2004M Firmware 15.27.2; Iptime Ax3000Q Firmware 15.27.2; Iptime Ax6000M Firmware 15.27.2; Iptime T5008 Firmware 15.27.2. Check the vendor advisory for mitigations.

References

• https://iptime.com/iptime/?page_id=126&dffid=1&dfsid=15&dftid=589&uid=26901&mod=document
• https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71987

Get alerted when CVE-2026-24498 or the next vulnerability affects your stack