CVE-2026-126953: Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that setUserUsername() in obuspasystem.lua passes to os.execute(), gaining root command execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to act as the device's Auto-Configuration Server (ACS), or compromise the ACS that manages the router. Exploitation does not require authentication or user interaction once the attacker can send the relevant TR-098 SetParameterValues request.
Which systems are affected?
Cudy TR3000 devices running firmware before version 2.5.42 are affected. Version 2.5.42 is identified as the fixed version.
What is the impact of successful exploitation?
A malicious or compromised ACS can inject shell metacharacters into the InternetGatewayDevice.User.{i}.Username parameter. The device passes this value to os.execute(), allowing commands to run as root with full confidentiality, integrity, and availability impact.
What should be done if the router cannot be updated immediately?
Limit and protect ACS access, since exploitation depends on an attacker controlling or impersonating the ACS. Review the configured ACS and prevent untrusted systems from sending TR-098 SetParameterValues requests.