BaseFortify

Executive Summary

CVE-2026-129103 is a command injection flaw in Cudy TR3000 devices running firmware before 2.5.42. Authenticated administrators can exploit it by injecting newline characters and crontab entries into the reboot_time parameter. This causes the /etc/init.d/autoreboot script to write malicious commands to the root crontab, which are then executed by the cron daemon with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if your Cudy TR3000 device is running firmware version prior to 2.5.42. Inspect the root crontab for unexpected entries by running 'crontab -l -u root' on the device. Look for suspicious crontab lines that may indicate command injection attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could execute arbitrary root commands, leading to full system compromise. This includes installing malware, stealing data, or disrupting device operations. The impact depends on the device's role in the network and the attacker's goals.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Cudy TR3000 firmware to version 2.5.42 or later immediately. If immediate upgrade is not possible, restrict administrative access to the device and monitor for unauthorized crontab modifications.

Useful 0 Not Useful 0