Command Injection in Cudy TR3000 Router

Executive Summary

CVE-2026-75487 is a command injection vulnerability in Cudy TR3000 routers running firmware before 2.5.42. It allows authenticated administrators to execute arbitrary root commands by injecting malicious code into the WireGuard server's private_key field. When the private key is exported, the system passes it to luci.sys.exec without proper sanitization, enabling command substitution attacks using syntax like $().

Successful exploitation could lead to full system compromise, including unauthorized access, data theft, or disruption of services.

Useful 0 Not Useful 0

Detection Guidance

Check if your Cudy TR3000 router is running firmware versions prior to 2.5.42. Log in to the admin interface and verify the firmware version under system settings. If vulnerable, inspect WireGuard server configurations for private keys containing command substitution patterns like $().

Use SSH to access the router and run: cat /etc/version to check firmware version. Examine WireGuard configurations in /etc/config/wireguard for suspicious private keys.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator of a vulnerable Cudy TR3000 router, an attacker with admin access could exploit this to run malicious commands as root. This could allow them to take control of your network, steal sensitive data, install malware, or disrupt operations.

Even if you are not an administrator, if an attacker gains admin access through other means, they could exploit this vulnerability to escalate privileges and cause significant damage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations could face legal penalties, fines, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Cudy TR3000 firmware to version 2.5.42 or later immediately. Disable WireGuard server functionality if not needed. Rotate all WireGuard private keys and credentials.

Restrict administrative access to the router interface. Monitor network traffic for unusual outbound connections. Apply firewall rules to limit WireGuard server exposure.

Useful 0 Not Useful 0