CVE-2026-75490: Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise cudycmagent.tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An unauthenticated attacker on the router's upstream Ethernet segment can exploit it. The attack is adjacent-network rather than Internet-wide, based on the supplied attack vector.
What does an attacker need to do to achieve code execution?
The attacker must advertise mDNS _cudycmagent._tcp records that direct the device to a malicious MQTT broker. They can then send commands encrypted with the fixed AES key, which router/batchcmd.lua executes with root privileges.
Which devices should be considered affected?
Cudy TR3000 devices running a version earlier than 2.5.42 should be considered affected. Version 2.5.42 is identified as the fixed release.