CVE-2026-75487: Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server privatekey option. Attackers can save a private key containing $() command substitution, which runs when actionwireguardsexport() passes it to luci.sys.exec during configuration export.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cudy TR3000to a version that resolves this vulnerability.Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator is required. The vulnerable path is the WireGuard server private_key setting during configuration export, and successful exploitation runs commands as root.
What input triggers command execution?
An attacker can save a WireGuard private key containing $() command substitution. The substitution is executed when the WireGuard configuration is exported.
Which versions need remediation?
Cudy TR3000 versions before 2.5.42 are affected. Updating to 2.5.42 or later addresses the stated affected-version range.