CVE-2026-75495: Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspasystem.lua concatenates into a luci.util.exec() command string, gaining root command execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Cudy TR3000 devices running versions before 2.5.42 are affected when they accept TR-098 SetParameterValues requests from an ACS. The attack path involves the InternetGatewayDevice.User.{i}.Password parameter.
What access does an attacker need to exploit it?
An attacker does not need device credentials or user interaction, but must be able to act as a malicious ACS or compromise the ACS that sends management requests to the device. Exploitation requires sending a crafted SetParameterValues request containing shell metacharacters in the password parameter.
What level of access can exploitation provide?
Successful exploitation results in command execution as root on the affected device. This can affect confidentiality, integrity, and availability.
What remediation is identified?
Upgrade affected Cudy TR3000 devices to version 2.5.42 or later. The vulnerability affects versions before 2.5.42.