EIP-2026-101534

PRE-CVE

ATCOM PBX IP01 / IP08 / IP4 / IP2G4A - Authentication Bypass

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101534. PoCs published by i-Hmx.

AI-analyzed exploit summary This exploit describes an authentication bypass vulnerability in ATCOM PBX systems (IP01, IP08, IP4G, and IP2G4A) due to improper cookie validation. The system checks for the presence of a 'username' cookie without verifying its authenticity, allowing an attacker to set 'username=admin' and gain administrative access.

Description

ATCOM PBX IP01 / IP08 / IP4 / IP2G4A - Authentication Bypass

Exploits (1)

exploitdb WRITEUP
by i-Hmx · textwebappshardware
https://www.exploit-db.com/exploits/39962

This exploit describes an authentication bypass vulnerability in ATCOM PBX systems (IP01, IP08, IP4G, and IP2G4A) due to improper cookie validation. The system checks for the presence of a 'username' cookie without verifying its authenticity, allowing an attacker to set 'username=admin' and gain administrative access.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: ATCOM PBX systems (IP01, IP08, IP4G, IP2G4A)
No auth needed
Prerequisites: Access to the target system's web interface · Ability to modify HTTP headers or browser cookies
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026