Command Injection in Cudy TR3000 Router Firmware

Executive Summary

CVE-2026-75576 is a command injection vulnerability in Cudy TR3000 routers running firmware before 2.5.42. It allows authenticated administrators to execute root-level commands by uploading a malicious OpenVPN config file with a filename containing shell substitution syntax like $(). The filename is processed by a Lua handler and passed to /bin/sh -c, enabling command execution.

Useful 0 Not Useful 0

Detection Guidance

Check if your Cudy TR3000 router is running firmware versions prior to 2.5.42. Log in to the admin interface and verify the firmware version under system settings. If vulnerable, inspect uploaded OpenVPN configuration filenames for shell substitution patterns like $().

Use network scanning tools to identify Cudy TR3000 devices on your network. Check for any unusual command execution logs or unexpected processes running as root.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could exploit this to run arbitrary commands as root, potentially taking full control of the router. This could lead to network compromise, data theft, or disruption of services. The high CVSS score indicates severe impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. Organizations using affected routers may face compliance failures, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Cudy TR3000 firmware to version 2.5.42 or later immediately. Disable administrative access to the router from untrusted networks. Monitor for any signs of compromise, such as unauthorized command execution or unusual network traffic.

Useful 0 Not Useful 0