CVE-2026-32833: Cudy LT300 3.0 OS command injection

• Affected versions: firmware before 2.5.12; reproduced against LT300V3-R100-2.4.5-20250519-131314.
• Fixed/control version: LT300V3-R100-2.5.12-20260518-234632.
• Risk level and consequences: high. An attacker with access to the administrative interface/session can execute shell commands in the router firmware context by submitting crafted time-setting form data. On a physical router this can lead to device compromise, persistence, traffic interception, or pivoting from the router.

Impact Parity

• Disclosed/claimed maximum impact: code execution / OS command injection via a router administrative interface API endpoint.
• Reproduced impact from this run: code execution. The reproduction created attacker-chosen proof files with controlled contents by sending HTTP POST requests to the original firmware /cgi-bin/luci/admin/system/systime endpoint through the firmware uhttpd server and original /www/cgi-bin/luci LuCI dispatcher/CBI path.
• Parity: full.
• Not demonstrated: no post-exploitation persistence or interactive shell was attempted; the proof stops after deterministic command execution side effects.

Root Cause

The root cause is unsafe construction of a shell command from HTTP form input in the LuCI system time handler. In the vulnerable 2.4.5 firmware, the system time page includes bytecode string markers showing the affected flow: timeclock, date -s '%s', and fork_exec. When the CBI form is submitted with the manual time-setting option, the user-supplied cbid.system.ntp.current/time value is used in a date -s '<user value>' command. Because the value is surrounded by single quotes but not sanitized before shell execution, an attacker can close the quote and append a shell command, e.g. 2025-01-01 12:00:00'; echo MARKER > /tmp/proof; #.

The fixed 2.5.12 firmware preserves the same endpoint and command structure but adds a gsub sanitization marker in the same systime.lua handler before fork_exec. The fixed negative-control runs reached the same product endpoint and form handler but did not create the attacker-controlled proof files.

No public fix commit was provided in the ticket. The reproduction compares vendor firmware images directly: vulnerable LT300V3-R100-2.4.5-20250519-131314 versus fixed LT300V3-R100-2.5.12-20260518-234632.

Reproduction Steps

1. Use bundle/repro/reproduction_steps.sh.
2. The script:
   • Downloads or reuses the vendor LT300 V3 2.4.5 and 2.5.12 firmware zip files.
   • Extracts their SquashFS root filesystems.
   • Runs the firmware usr/sbin/uhttpd under qemu-mipsel and proot.
   • Uses the original firmware /www/cgi-bin/luci, luci.dispatcher, luci.cbi, and usr/lib/lua/luci/model/cbi/system/systime.lua path for the endpoint.
   • Adds only emulation shims for router-only services/hardware state (ubus session, bdinfo, and route-forbidden state) so the firmware web interface can run outside physical hardware; it does not replace the vulnerable endpoint handler.
   • Sends two vulnerable HTTP POST attempts to /cgi-bin/luci/admin/system/systime with payloads in cbid.system.ntp.current.
   • Sends two equivalent fixed-version negative-control attempts through the same endpoint.
3. Expected evidence:
   • Vulnerable attempts create proof files containing VULN_ATTEMPT_1_COMMAND_EXECUTED and VULN_ATTEMPT_2_COMMAND_EXECUTED.
   • Fixed attempts do not create proof files.
   • GET requests for both versions render the original System Time CBI form and include cbid.system.ntp.current, proving endpoint reachability.

Evidence

Primary runtime evidence:

• bundle/logs/reproduction_steps.log records successful runs.
• bundle/repro/runtime_manifest.json records the runtime endpoint path, service_started=true, healthcheck_passed=true, and target_path_reached=true.
• bundle/logs/artifacts/product/proof_summary.txt contains:
  • vuln attempt 1 proof: VULN_ATTEMPT_1_COMMAND_EXECUTED
  • vuln attempt 2 proof: VULN_ATTEMPT_2_COMMAND_EXECUTED
  • fixed attempt 1 no proof file (negative control passed)
  • fixed attempt 2 no proof file (negative control passed)
• bundle/logs/artifacts/http/vuln_attempt1_request.txt and bundle/logs/artifacts/http/vuln_attempt2_request.txt contain the malicious POST fields sent to /cgi-bin/luci/admin/system/systime.
• bundle/logs/artifacts/http/vuln_attempt1_response_headers.txt shows HTTP/1.1 200 OK and X-CBI-State: 1 for a submitted form.
• bundle/logs/artifacts/http/fixed_attempt1_response_headers.txt shows the fixed endpoint was reached but did not accept the injected payload as a successful proof-producing command.
• bundle/logs/code_comparison.txt and bundle/logs/artifacts/product/code_identity.txt capture firmware code identity and string-level handler differences. The vulnerable handler shows timeclock, date -s '%s', and fork_exec; the fixed handler additionally shows gsub.

Environment details:

• Firmware rootfs execution used qemu-mipsel and proot in user-mode emulation.
• The production-facing server was the firmware uhttpd binary serving the original firmware web root.
• The entrypoint was the HTTP endpoint /cgi-bin/luci/admin/system/systime.

Recommendations / Next Steps

• Upgrade Cudy LT300 3.0 devices to firmware 2.5.12 or newer.
• Do not build shell commands by concatenating or formatting raw HTTP form values. Use argument-vector APIs where possible, or strictly validate time values against a narrow date/time grammar before invoking any command.
• If shell invocation is unavoidable, reject metacharacters such as quotes, semicolons, backticks, pipes, ampersands, redirection operators, $(), and newlines, and add regression tests for command-injection payloads.
• Add endpoint-level tests for /cgi-bin/luci/admin/system/systime verifying that invalid time values fail closed and cannot create shell side effects.

Additional Notes

• Idempotency confirmation: bundle/repro/reproduction_steps.sh was run successfully multiple times consecutively after fixing non-root SquashFS extraction handling. Each run recreated fresh proof artifacts and revalidated both vulnerable and fixed firmware behavior.
• The run uses emulation shims for hardware/session dependencies that are normally present on a physical router. The vulnerability proof itself is not a reimplemented handler: the HTTP request traverses firmware uhttpd, original /www/cgi-bin/luci, LuCI dispatcher/CBI, and the original firmware systime.lua bytecode handler.
• The fixed-version negative control uses the actual fixed firmware handler rather than a hand-written surrogate.