ipTIME Routers OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in various ipTIME router models, allowing for pre-authentication remote code execution with root privileges. The issue arises in the UPnP relay function, which improperly sanitizes data before passing it to the system command execution. This vulnerability affects a wide range of ipTIME routers across different product lines and firmware versions.

Impact

Exploitation of this vulnerability allows for unauthorized remote code execution with root privileges on the affected router.

Reproduction

The vulnerability can be reproduced by sending a command injection payload through an SSDP/UPnP server. After manipulating the DHCP response to redirect traffic, the router is tricked into executing the injected command with root privileges.

Remediation

Users can upgrade to the latest firmware version, which includes the patch for this vulnerability. Instructions for downloading the patched firmware are available on the ipTIME website.