CVE-2026-75494: Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Cudy TR3000 devices running firmware earlier than 2.5.42 are affected where the TR-069 easycwmpd Upload handler processes ACS-supplied Username and Password values.
What does an attacker need to exploit it?
The attacker needs to be a malicious or compromised ACS able to supply crafted Username or Password values to the TR-069 Upload handler. No device credentials or user interaction are required according to the supplied vector.
What is the impact of successful exploitation?
Injected curl options can cause the root-run curl command to write attacker-controlled HTTP responses to arbitrary files on the device. This can affect device integrity and availability.
What should be done if the device cannot be updated immediately?
The provided information identifies the ACS as the exploitation path. Until firmware 2.5.42 or later can be installed, limit the device's TR-069 communication to a trusted, uncompromised ACS.