CVE-2026-75493: Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker would need to control or compromise the ACS used by the device. The vulnerable path involves setting the TR-098 WLANConfiguration KeyPassphrase value through SetParameterValues.
What conditions are required to trigger the denial of service?
The ACS must set a passphrase large enough to exceed the 4,096-byte stack buffer; the described proof condition is a 5,000-byte value. A later read of that KeyPassphrase parameter triggers the overflow and crashes obuspa.
What is the impact of successful exploitation?
Successful exploitation crashes the obuspa process, causing a denial of service. The provided data does not describe confidentiality loss or integrity impact.
Which versions are affected?
Cudy TR3000 versions before 2.5.42 are affected. Updating to 2.5.42 or later addresses the stated affected-version range.