CVE-2026-75492: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via stun_client UDP Parser
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stunclient TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stunclient for denial of service.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Cudy TR3000 devices running a version earlier than 2.5.42 are affected where the stun_client TR-111 UDP Connection Request parser can receive attacker-supplied UDP traffic.
Does exploitation require authentication or a valid TR-111 request?
No. The vulnerable parser processes the request before verifying the username or HMAC, so an unauthenticated attacker can trigger the issue with a crafted UDP datagram.
What is the practical impact of a successful exploit?
A single crafted UDP datagram with no space in its request line can overflow a 10-byte stack buffer and crash the stun_client process, causing denial of service.
What should be done to remediate the vulnerability?
Upgrade the Cudy TR3000 firmware to version 2.5.42 or later.