Command Injection in Cudy TR3000 Router

Executive Summary

CVE-2026-75577 is a command injection vulnerability in Cudy TR3000 routers running firmware before 2.5.42. It allows authenticated administrators to execute arbitrary root commands by injecting malicious code via a WireGuard private key containing shell substitution syntax like $(). The attacker triggers the vpn.export_conf method through a JSON-RPC endpoint, which passes the key to a wg pubkey shell command for execution.

Useful 0 Not Useful 0

Detection Guidance

Check if your Cudy TR3000 router is running firmware version prior to 2.5.42. Log in to the admin interface and verify the firmware version under system settings. If vulnerable, inspect WireGuard configurations for private keys containing shell substitution syntax like $().

Use network scanning tools to detect open ports and services on the router. Look for active JSON-RPC endpoints at /cgi-bin/luci/rpc/app. Monitor system logs for unusual command executions or unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could execute root-level commands on the router, potentially taking full control of the device, stealing data, or disrupting network operations. This could lead to unauthorized access to sensitive information or network compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Cudy TR3000 router firmware to version 2.5.42 or later immediately. Disable remote administration if not required. Remove any suspicious WireGuard private keys containing shell substitution syntax.

Restrict administrative access to trusted IPs only. Monitor network traffic for signs of exploitation. Consider disabling the VPN export_conf feature if not in use.

Useful 0 Not Useful 0