{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/paccaron/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Paccaron"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["A3004T (14.19.0)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","router-vulnerability","command-injection"],"_cs_type":"threat","_cs_vendors":["ipTIME"],"content_html":"\u003cp\u003eA publicly disclosed vulnerability in the ipTIME A3004T router (firmware version 14.19.0) allows for unauthenticated remote code execution (RCE). The flaw resides in the EAD service, which listens on UDP port 56026. The vulnerability stems from an insecure implementation of the handle_send_cmd() function (lines 473-580 in ead.c), where user-controlled input provided in an EAD_TYPE_SEND_CMD packet is passed directly to the system() function without sanitization. This permits an attacker to execute arbitrary commands with root privileges. Additional vectors identified in the source include buffer overflows, format string vulnerabilities, and path traversal within the EAD service components. Because the EAD service does not implement source IP filtering, any remote attacker can target this service directly.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify ipTIME A3004T devices reachable via UDP port 56026.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious EAD_TYPE_SEND_CMD packet (0x0a command code).\u003c/li\u003e\n\u003cli\u003eThe crafted packet includes a semi-colon followed by the target command to achieve command injection.\u003c/li\u003e\n\u003cli\u003eThe packet is transmitted via UDP to the target device on port 56026.\u003c/li\u003e\n\u003cli\u003eThe EAD service's handle_send_cmd() function receives and processes the unsanitized input.\u003c/li\u003e\n\u003cli\u003eThe system() binary is invoked by the service, executing the injected command.\u003c/li\u003e\n\u003cli\u003eAttacker gains arbitrary code execution with root-level privileges on the device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full device compromise, allowing an attacker to execute arbitrary commands with root privileges. This grants total control over the router, facilitating traffic interception, internal network pivoting, and denial of service. The vulnerability affects the ipTIME A3004T specifically on firmware 14.19.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eBlock inbound traffic to UDP port 56026 at the network perimeter.\u003c/li\u003e\n\u003cli\u003eAudit ipTIME A3004T devices for firmware version 14.19.0 and apply patches if available from the vendor.\u003c/li\u003e\n\u003cli\u003eDeploy network intrusion detection signatures to identify UDP packets containing the string \u0026quot;EAD_TYPE_SEND_CMD\u0026quot; followed by shell metacharacters like \u0026quot;;\u0026quot;.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unusual payloads targeting UDP port 56026.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T14:54:27Z","date_published":"2026-08-17T14:54:27Z","id":"https://feed.craftedsignal.io/briefs/2026-08-iptime-rce/","summary":"The ipTIME A3004T router (firmware 14.19.0) is vulnerable to pre-authentication remote code execution via a flaw in the EAD service, allowing root command injection.","title":"Remote Code Execution in ipTIME A3004T EAD Service","url":"https://feed.craftedsignal.io/briefs/2026-08-iptime-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Paccaron","version":"https://jsonfeed.org/version/1.1"}