IpTIME - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/iptime/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 14:54:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in ipTIME A3004T EAD Servicehttps://feed.craftedsignal.io/briefs/2026-08-iptime-rce/Mon, 17 Aug 2026 14:54:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-iptime-rce/The ipTIME A3004T router (firmware 14.19.0) is vulnerable to pre-authentication remote code execution via a flaw in the EAD service, allowing root command injection.A publicly disclosed vulnerability in the ipTIME A3004T router (firmware version 14.19.0) allows for unauthenticated remote code execution (RCE). The flaw resides in the EAD service, which listens on UDP port 56026. The vulnerability stems from an insecure implementation of the handle_send_cmd() function (lines 473-580 in ead.c), where user-controlled input provided in an EAD_TYPE_SEND_CMD packet is passed directly to the system() function without sanitization. This permits an attacker to execute arbitrary commands with root privileges. Additional vectors identified in the source include buffer overflows, format string vulnerabilities, and path traversal within the EAD service components. Because the EAD service does not implement source IP filtering, any remote attacker can target this service directly.

Attack Chain

  1. Attacker performs reconnaissance to identify ipTIME A3004T devices reachable via UDP port 56026.
  2. Attacker crafts a malicious EAD_TYPE_SEND_CMD packet (0x0a command code).
  3. The crafted packet includes a semi-colon followed by the target command to achieve command injection.
  4. The packet is transmitted via UDP to the target device on port 56026.
  5. The EAD service's handle_send_cmd() function receives and processes the unsanitized input.
  6. The system() binary is invoked by the service, executing the injected command.
  7. Attacker gains arbitrary code execution with root-level privileges on the device.

Impact

Successful exploitation results in full device compromise, allowing an attacker to execute arbitrary commands with root privileges. This grants total control over the router, facilitating traffic interception, internal network pivoting, and denial of service. The vulnerability affects the ipTIME A3004T specifically on firmware 14.19.0.

Recommendation

Prioritized, concrete actions for detection and mitigation:

  • Block inbound traffic to UDP port 56026 at the network perimeter.
  • Audit ipTIME A3004T devices for firmware version 14.19.0 and apply patches if available from the vendor.
  • Deploy network intrusion detection signatures to identify UDP packets containing the string "EAD_TYPE_SEND_CMD" followed by shell metacharacters like ";".
  • Monitor network traffic for unusual payloads targeting UDP port 56026.
]]>highthreatremote-code-executionrouter-vulnerabilitycommand-injection