OS Command Injection in Cudy TR3000 Router

Executive Summary

CVE-2026-126953 is an OS command injection flaw in Cudy TR3000 routers running firmware before 2.5.42. A malicious or compromised ACS can exploit this by sending a SetParameterValues request with shell metacharacters in the InternetGatewayDevice.User.{i}.Username field. The vulnerability occurs because the set_UserUsername() function in obuspa_system.lua passes this input directly to os.execute(), allowing attackers to execute arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking the Cudy TR3000 firmware version. If it is below 2.5.42, the device is vulnerable. Use commands like 'ssh admin@router' and 'cat /etc/version' or check the web interface for firmware details.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full root access to the router. With root access, attackers can install malware, intercept network traffic, modify router settings, or use the device as a pivot point to attack other systems on the network. It could also lead to unauthorized data access or denial-of-service conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Cudy TR3000 routers may face compliance violations, potential data breaches, and regulatory penalties due to insufficient network security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Cudy TR3000 firmware to version 2.5.42 or later. Disable remote management features if not required and restrict access to the ACS (Auto Configuration Server) to trusted sources only.

Useful 0 Not Useful 0