CVE-2026-75488: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via CWMP Basic Authorization Builder
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Cudy TR3000 devices running firmware earlier than 2.5.42 are affected when their CWMP client communicates with an attacker-controlled ACS.
What does an attacker need to exploit the vulnerability?
The attacker must control the ACS used by the device's CWMP/TR-069 client. They can provide oversized Username or Password values in TR-069 Download or Upload requests; no authentication or user interaction is required.
What is the practical impact of successful exploitation?
Oversized credentials can overflow 128-byte stack buffers in the CWMP process and corrupt stack memory. The described confirmed impact is a crash of the CWMP process.
What should be done if an immediate firmware update is not possible?
Prevent the device's CWMP client from connecting to untrusted or attacker-controlled ACS infrastructure. Restrict access to and control of the configured ACS until firmware 2.5.42 or later can be deployed.