CVE-2024-30167

This Go-based exploit demonstrates an authenticated command injection vulnerability in Atlona AT-OME-RX21 devices. It sends a crafted JSON payload to the `/cgi-bin/time.cgi` endpoint, injecting a command that exfiltrates output via a curl POST request to an attacker-controlled server.

This repository contains a functional Go-based exploit for CVE-2024-30167, an authenticated command injection vulnerability in Atlona AT-OME-RX21 firmware <= 1.5.1. The exploit leverages the time configuration interface to execute arbitrary commands as root via crafted JSON payloads.