CVE-2026-38710

A command injection vulnerability in the system.setclock web interface affects TR1200 (versions up to v2.4.15) and TR3000 (versions up to v2.4.21). The handler receives a time parameter and passes it to a shell utility like date or ntpd without sanitization, allowing arbitrary command execution as the web server's user. Patches are available in v2.4.16 and v2.4.22, though the actual commit diff has not been publicly reviewed to confirm whether the fix replaces system() with a safe library call or merely adds input filtering — the latter would leave a recurrence waiting to happen. The CVSS 7.2 reflects network-level authentication requirement, but this caveat is weaker than it appears for embedded devices. Management interfaces on TR1200/TR3000 hardware are often accessible from any device on the same subnet, may ship with default credentials, and serve as infrastructure nodes in networks containing PLCs, medical devices, or SCADA controllers. Compromising the time-setter becomes a lateral movement pivot, not merely a root shell on a forgotten router. Deployments in the field likely run the vulnerable versions. These devices follow the common embedded pattern: deployed, forgotten, and rarely updated over their operational lifetime. The EPSS score of 0.02546 reflects low automated scanning interest, but this measures opportunistic mass-scanning against public assets — not targeted exploitation against specific hardware on enterprise segments. For defenders, priority actions are: verify which firmware version your TR1200/TR3000 units are running, confirm the management interface is isolated to a dedicated VLAN with no WAN exposure, and treat any device unable to update to the patched version as a segmentation boundary requiring compensating controls.

Reviewed through automated stages and approved by a human before publication.