Unauthenticated Stack Buffer Overflow in Cudy TR3000

Executive Summary

CVE-2026-75492 is a stack buffer overflow vulnerability in Cudy TR3000 routers before version 2.5.42. The flaw exists in the stun_client TR-111 UDP Connection Request parser, which processes requests before checking authentication details like username or HMAC. A remote attacker can exploit this by sending a single malformed UDP datagram missing a space in the request line, causing a 10-byte stack buffer to overflow and crash the stun_client process, leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for malformed UDP datagrams targeting the TR-111 service on Cudy TR3000 devices. Check for crashes in the stun_client process or unusual UDP traffic patterns on port 3478 (default STUN port). Use packet capture tools like tcpdump or Wireshark to inspect UDP traffic for malformed TR-111 requests lacking a space in the request line.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to crash the stun_client service on affected Cudy TR3000 routers, causing network disruptions. The denial of service could interrupt internet connectivity or other network-dependent services for users relying on these routers. Since the attack requires only a single crafted UDP packet, it can be executed remotely without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Cudy TR3000 firmware to version 2.5.42 or later to patch the stack buffer overflow. If an update is unavailable, disable the TR-111 service or block external UDP traffic to the device's STUN port (3478) at the network perimeter. Monitor device logs for crashes or exploit attempts.

Useful 0 Not Useful 0