OS Command Injection in Cudy TR3000 Router

Executive Summary

CVE-2026-75495 is an OS command injection flaw in Cudy TR3000 routers running firmware before 2.5.42. A malicious or compromised ACS can exploit this by sending a crafted SetParameterValues request with shell metacharacters in the InternetGatewayDevice.User.{i}.Password parameter. The obuspa_system.lua script improperly combines this input into a luci.util.exec() command, allowing root command execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the firmware version of your Cudy TR3000 router. If it is running a version prior to 2.5.42, it is vulnerable. You can verify the firmware version through the router's web interface or by running commands like 'cat /etc/version' or 'ubus call system board' on the device if you have shell access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands as root on affected routers. This could lead to full system compromise, unauthorized access, data theft, or disruption of network services. Attackers need network access to exploit it.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware of your Cudy TR3000 router to version 2.5.42 or later. This can typically be done through the router's web interface under the firmware update section. Ensure the update is obtained from the official Cudy website to avoid malicious versions.

Useful 0 Not Useful 0