ipTIME A3004T Remote Code Execution

The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EADTYPESENDCMD packet to execute arbitrary commands on the device with root privileges. Exploit Title: ipTIME A3004T - Remote Code Execution Date...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

ipTIME A3004T - Remote Code Execution

Exploit Title: ipTIME A3004T - Remote Code Execution Date: 2026-06-29 Exploit Author: Paccaron Vendor Homepage: https://www.iptime.com Software Link: https://www.iptime.com/iptime/?pageid=147&pid=34 Version: 14.19.0 Tested on: ipTIME A3004T Physical Device, OpenWRT based, MediaTek MT7621 CVE: N/A...