Remote Code Execution in Cudy TR3000 Router

Executive Summary

Cudy TR3000 before 2.5.42 has a remote code execution flaw allowing unauthenticated attackers on the same network segment to execute root commands. The flaw involves advertising a fake automesh controller via mDNS, which tricks the router into connecting to a malicious MQTT broker. Commands sent to the router are decrypted using a hardcoded AES key and executed as root by the router's batchcmd.lua script.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by monitoring for unauthorized _cudycmagent._tcp service advertisements on your network using mDNS tools like avahi-browse or dns-sd. Check for unexpected MQTT brokers or rogue automesh controllers on the upstream Ethernet segment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full control of the affected Cudy TR3000 router. They can execute arbitrary commands with root privileges, potentially leading to data theft, network compromise, or disruption of services. Since the attack can be carried out remotely without authentication, it poses a significant risk to network security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful exploit may violate these regulations, leading to legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Cudy TR3000 devices to firmware version 2.5.42 or later. Block unauthorized mDNS advertisements at the network perimeter and restrict MQTT traffic to trusted sources. Disable or audit batchcmd.lua for unauthorized commands.

Useful 0 Not Useful 0