CVE-2026-129103: Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time

Q: Who can exploit this issue?

An attacker must be authenticated as an administrator on a vulnerable Cudy TR3000 device. The attack can be performed remotely over the network and does not require user interaction.

Q: What access does successful exploitation provide?

The injected crontab entry is written to the root crontab and executed by crond. This allows the authenticated attacker to run commands as root, with full confidentiality, integrity, and availability impact on the device.

Q: What should administrators do if they suspect exploitation?

Inspect the root crontab for unexpected entries, particularly lines that could have been introduced through the scheduled reboot setting. Upgrade affected devices to version 2.5.42 or later, since versions before 2.5.42 are affected.

Published Nov 13, 2026

Updated

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboottime. Attackers can submit a reboottime value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.

Affected Software

1 affected component

Cudy TR3000<2.5.42

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42

Event History

Nov 13, 2026

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated as an administrator on a vulnerable Cudy TR3000 device. The attack can be performed remotely over the network and does not require user interaction.

What access does successful exploitation provide?

The injected crontab entry is written to the root crontab and executed by crond. This allows the authenticated attacker to run commands as root, with full confidentiality, integrity, and availability impact on the device.

What should administrators do if they suspect exploitation?

Inspect the root crontab for unexpected entries, particularly lines that could have been introduced through the scheduled reboot setting. Upgrade affected devices to version 2.5.42 or later, since versions before 2.5.42 are affected.

CVE-2026-129103: Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

What should administrators do if they suspect exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

What should administrators do if they suspect exploitation?