CVE-2026-129104: Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp
Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.setdhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs authenticated administrator access to the router and must be able to supply a newline in the net.set_dhcp leasetime field.
What can an attacker do after exploiting the injection?
An attacker can append dnsmasq address= directives to alter DNS answers provided to LAN clients. They can also inject invalid configuration lines that stop dnsmasq.