CVE-2026-32833: Verified Repro With Script Download

• Affected versions: firmware before 2.5.12; reproduced against LT300V3-R100-2.4.5-20250519-131314.
• Fixed/control version: LT300V3-R100-2.5.12-20260518-234632.
• Risk level and consequences: high. An attacker with access to the administrative interface/session can execute shell commands in the router firmware context by submitting crafted time-setting form data. On a physical router this can lead to device compromise, persistence, traffic interception, or pivoting from the router.

Impact Parity

• Disclosed/claimed maximum impact: code execution / OS command injection via a router administrative interface API endpoint.
• Reproduced impact from this run: code execution. The reproduction created attacker-chosen proof files with controlled contents by sending HTTP POST requests to the original firmware /cgi-bin/luci/admin/system/systime endpoint through the firmware uhttpd server and original /www/cgi-bin/luci LuCI dispatcher/CBI path.
• Parity: full.
• Not demonstrated: no post-exploitation persistence or interactive shell was attempted; the proof stops after deterministic command execution side effects.

Root Cause

The root cause is unsafe construction of a shell command from HTTP form input in the LuCI system time handler. In the vulnerable 2.4.5 firmware, the system time page includes bytecode string markers showing the affected flow: timeclock, date -s '%s', and fork_exec. When the CBI form is submitted with the manual time-setting option, the user-supplied cbid.system.ntp.current/time value is used in a date -s '<user value>' command. Because the value is surrounded by single quotes but not sanitized before shell execution, an attacker can close the quote and append a shell command, e.g. 2025-01-01 12:00:00'; echo MARKER > /tmp/proof; #.

The fixed 2.5.12 firmware preserves the same endpoint and command structure but adds a gsub sanitization marker in the same systime.lua handler before fork_exec. The fixed negative-control runs reached the same product endpoint and form handler but did not create the attacker-controlled proof files.

No public fix commit was provided in the ticket. The reproduction compares vendor firmware images directly: vulnerable LT300V3-R100-2.4.5-20250519-131314 versus fixed LT300V3-R100-2.5.12-20260518-234632.

Reproduction Steps

1. Use bundle/repro/reproduction_steps.sh.
2. The script:
   • Downloads or reuses the vendor LT300 V3 2.4.5 and 2.5.12 firmware zip files.
   • Extracts their SquashFS root filesystems.
   • Runs the firmware usr/sbin/uhttpd under qemu-mipsel and proot.
   • Uses the original firmware /www/cgi-bin/luci, luci.dispatcher, luci.cbi, and usr/lib/lua/luci/model/cbi/system/systime.lua path for the endpoint.
   • Adds only emulation shims for router-only services/hardware state (ubus session, bdinfo, and route-forbidden state) so the firmware web interface can run outside physical hardware; it does not replace the vulnerable endpoint handler.
   • Sends two vulnerable HTTP POST attempts to /cgi-bin/luci/admin/system/systime with payloads in cbid.system.ntp.current.
   • Sends two equivalent fixed-version negative-control attempts through the same endpoint.
3. Expected evidence:
   • Vulnerable attempts create proof files containing VULN_ATTEMPT_1_COMMAND_EXECUTED and VULN_ATTEMPT_2_COMMAND_EXECUTED.
   • Fixed attempts do not create proof files.
   • GET requests for both versions render the original System Time CBI form and include cbid.system.ntp.current, proving endpoint reachability.

Evidence

Primary runtime evidence:

• bundle/logs/reproduction_steps.log records successful runs.
• bundle/repro/runtime_manifest.json records the runtime endpoint path, service_started=true, healthcheck_passed=true, and target_path_reached=true.
• bundle/logs/artifacts/product/proof_summary.txt contains:
  • vuln attempt 1 proof: VULN_ATTEMPT_1_COMMAND_EXECUTED
  • vuln attempt 2 proof: VULN_ATTEMPT_2_COMMAND_EXECUTED
  • fixed attempt 1 no proof file (negative control passed)
  • fixed attempt 2 no proof file (negative control passed)
• bundle/logs/artifacts/http/vuln_attempt1_request.txt and bundle/logs/artifacts/http/vuln_attempt2_request.txt contain the malicious POST fields sent to /cgi-bin/luci/admin/system/systime.
• bundle/logs/artifacts/http/vuln_attempt1_response_headers.txt shows HTTP/1.1 200 OK and X-CBI-State: 1 for a submitted form.
• bundle/logs/artifacts/http/fixed_attempt1_response_headers.txt shows the fixed endpoint was reached but did not accept the injected payload as a successful proof-producing command.
• bundle/logs/code_comparison.txt and bundle/logs/artifacts/product/code_identity.txt capture firmware code identity and string-level handler differences. The vulnerable handler shows timeclock, date -s '%s', and fork_exec; the fixed handler additionally shows gsub.

Environment details:

• Firmware rootfs execution used qemu-mipsel and proot in user-mode emulation.
• The production-facing server was the firmware uhttpd binary serving the original firmware web root.
• The entrypoint was the HTTP endpoint /cgi-bin/luci/admin/system/systime.

Recommendations / Next Steps

• Upgrade Cudy LT300 3.0 devices to firmware 2.5.12 or newer.
• Do not build shell commands by concatenating or formatting raw HTTP form values. Use argument-vector APIs where possible, or strictly validate time values against a narrow date/time grammar before invoking any command.
• If shell invocation is unavoidable, reject metacharacters such as quotes, semicolons, backticks, pipes, ampersands, redirection operators, $(), and newlines, and add regression tests for command-injection payloads.
• Add endpoint-level tests for /cgi-bin/luci/admin/system/systime verifying that invalid time values fail closed and cannot create shell side effects.

Additional Notes

• Idempotency confirmation: bundle/repro/reproduction_steps.sh was run successfully multiple times consecutively after fixing non-root SquashFS extraction handling. Each run recreated fresh proof artifacts and revalidated both vulnerable and fixed firmware behavior.
• The run uses emulation shims for hardware/session dependencies that are normally present on a physical router. The vulnerability proof itself is not a reimplemented handler: the HTTP request traverses firmware uhttpd, original /www/cgi-bin/luci, LuCI dispatcher/CBI, and the original firmware systime.lua bytecode handler.
• The fixed-version negative control uses the actual fixed firmware handler rather than a hand-written surrogate.

Fix Coverage / Assumptions

• The original fix appears to rely on removing the ability for a user-controlled time string to break out of the single-quoted date -s '%s' shell argument.
• The fixed 2.5.12 firmware explicitly covers:
  • usr/lib/lua/luci/model/cbi/system/systime.lua, the original /cgi-bin/luci/admin/system/systime CBI form path. String markers show date -s '%s', gsub, and fork_exec in the fixed handler.
  • usr/lib/lua/luci/apprpc/system.lua, the JSON-RPC application API path. String markers show date -s '%s', gsub, and fork_exec in the fixed handler.
• The fixed RPC endpoint returned an application-level error for the malicious parameter: Invalid Parameter, and no proof file was created.
• No SECURITY.md or detailed threat-model file was present inside the firmware rootfs. Cudy has a public “Report Vulnerability” page, but the extracted page did not publish exclusions that would make authenticated administrative command injection out of scope. The tested path crosses the same network administrative trust boundary as the parent issue, not a local-file or self-attack boundary.
• The fix does not remove shell use entirely; it still leaves shell-command construction (date -s '%s') present. However, the tested quote-breakout data path is covered in both observed time-setting handlers in 2.5.12.

Variant / Alternate Trigger

The confirmed alternate path is the LuCI JSON-RPC application endpoint rather than the CBI HTML form endpoint:

• Parent entrypoint: POST /cgi-bin/luci/admin/system/systime, form field cbid.system.ntp.current, CBI model usr/lib/lua/luci/model/cbi/system/systime.lua.
• Variant entrypoint: POST /cgi-bin/luci/rpc/app, JSON-RPC method system.setclock, JSON params[0], application RPC module usr/lib/lua/luci/apprpc/system.lua.
• Sink: luci.sys.call() invoking date -s '%s' with the attacker-controlled time string in vulnerable firmware.

The variant reproducer sends JSON like:

{"jsonrpc":"2.0","id":1,"method":"system.setclock","params":["2025-01-01 12:00:00'; echo VULN_RPC_SETCLOCK_VARIANT_EXECUTED > /root/vuln_rpc_variant_proof; #"]}

On firmware 2.4.5 this creates /root/vuln_rpc_variant_proof in the emulated firmware root. On firmware 2.5.12 the same request does not create /root/fixed_rpc_variant_proof.

• Affected version tested: LT300V3-R100-2.4.5-20250519-131314.
• Fixed/control version tested: LT300V3-R100-2.5.12-20260518-234632.
• Risk level and consequences: high for affected firmware. An authenticated attacker with access to the router administrative web/RPC interface can execute shell commands in the router firmware context via JSON-RPC, leading to device compromise, persistence opportunities, traffic interception, or lateral movement from the router.

Impact Parity

• Disclosed/claimed maximum impact for the parent: OS command injection / code execution through the router administrative interface.
• Reproduced impact from this variant run: command execution through a different HTTP entrypoint. The vulnerable 2.4.5 run created VULN_RPC_SETCLOCK_VARIANT_EXECUTED via JSON-RPC.
• Parity: full for the vulnerable-version alternate trigger; none for bypass against fixed 2.5.12.
• Not demonstrated: persistence, interactive shell, unauthenticated access, and post-exploitation actions were not attempted. The fixed firmware did not execute the payload.

Root Cause

The same underlying bug class is reachable from a second LuCI time-setting surface in the vulnerable firmware. In usr/lib/lua/luci/apprpc/system.lua, the exported setclock function accepts a time string from JSON-RPC and passes it to a shell command template containing date -s '%s'. Because vulnerable 2.4.5 does not sanitize a single quote in that string, the input closes the shell quote and appends an attacker command. The fixed 2.5.12 firmware keeps the command template but adds quote handling/validation (gsub marker and runtime Invalid Parameter response), preventing the tested breakout. No public source-code fix commit was supplied; analysis compares vendor firmware images directly.

Reproduction Steps

1. Run bundle/vuln_variant/reproduction_steps.sh.
2. The script:
   • Acquires or reuses vendor LT300 V3 firmware images for 2.4.5 and 2.5.12.
   • Extracts their SquashFS root filesystems.
   • Runs the original firmware uhttpd and LuCI RPC stack under qemu-mipsel/proot.
   • Adds only emulation shims for router-only session/hardware dependencies.
   • Sends the same JSON-RPC system.setclock command-injection payload to vulnerable and fixed firmware.
3. Expected evidence:
   • Vulnerable 2.4.5 creates vuln_rpc_variant_proof containing VULN_RPC_SETCLOCK_VARIANT_EXECUTED.
   • Fixed 2.5.12 does not create fixed_rpc_variant_proof and returns an invalid-parameter style response.
   • The script exits 1 because this is an alternate trigger on the vulnerable version, not a fixed-version bypass.

Evidence

Primary evidence files:

• bundle/logs/vuln_variant/reproduction_steps.log records the successful side-by-side test.
• bundle/logs/vuln_variant/product/proof_summary.txt contains:
  • vuln proof: VULN_RPC_SETCLOCK_VARIANT_EXECUTED
  • fixed no proof file (negative control passed)
• bundle/logs/vuln_variant/http/vuln_rpc_request.json contains the malicious JSON-RPC request to /cgi-bin/luci/rpc/app.
• bundle/logs/vuln_variant/http/vuln_rpc_response_body.txt shows a JSON-RPC response with result:null from the vulnerable target.
• bundle/logs/vuln_variant/http/fixed_rpc_response_body.txt shows the fixed target returned Invalid Parameter for the same payload.
• bundle/logs/vuln_variant/product/code_identity.txt records firmware versions and hashes for uhttpd, /www/cgi-bin/luci, luci/controller/rpc.lua, luci/app.lua, luci/apprpc/system.lua, and model/cbi/system/systime.lua.
• bundle/vuln_variant/runtime_manifest.json records the runtime endpoint and tested versions.

Environment details:

• Runtime used Cudy firmware rootfs, firmware uhttpd, LuCI JSON-RPC dispatcher, qemu-mipsel, and proot.
• Firmware versions came from /etc/rom_version: vulnerable 2.4.5-20250519-131314, fixed 2.5.12-20260518-234632.

Recommendations / Next Steps

• Keep the 2.5.12 fix coverage for both model/cbi/system/systime.lua and luci/apprpc/system.lua; regression tests should include both /admin/system/systime and /rpc/app system.setclock.
• Prefer eliminating shell interpolation entirely: call date-setting functionality without /bin/sh, or strictly parse time input into numeric year/month/day/hour/min/sec components before execution.
• Add a centralized helper for time-setting input validation so future LuCI, RPC, mobile-app, or setup-wizard paths cannot reintroduce separate quoting logic.
• Add negative tests for quotes, semicolons, backticks, pipes, redirection, $(), newlines, and encoded variants for every administrative endpoint that reaches shell execution.

Additional Notes

• Idempotency was confirmed by running bundle/vuln_variant/reproduction_steps.sh twice; both runs completed and produced the same verdict.
• This is a meaningful alternate entrypoint but not a fixed-version bypass. The coding stage should treat it as evidence that the complete fix must cover all time-setting APIs, not only the originally reported CBI page.