Executive Summary

CVE-2026-32833 is an OS command injection vulnerability found in Cudy LT300 3.0 routers running firmware versions prior to 2.5.12. It allows authenticated attackers to execute arbitrary commands on the device by injecting shell metacharacters into the 'cbid.system.ntp.current' POST parameter within the system time configuration interface. This means attackers can send malicious payloads through the NTP settings endpoint to remotely execute code on the underlying system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact as it allows attackers with authentication to remotely execute arbitrary commands on the affected device. This can lead to full compromise of the router, potentially allowing attackers to control network traffic, intercept data, disrupt network services, or use the device as a foothold for further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves OS command injection via the 'cbid.system.ntp.current' POST parameter in the NTP configuration interface of Cudy LT300 3.0 routers running firmware prior to version 2.5.12.

Detection would involve monitoring or inspecting POST requests to the NTP settings endpoint for suspicious payloads containing shell metacharacters or unusual command injection patterns.

Specific commands to detect exploitation attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update the Cudy LT300 3.0 router firmware to version 2.5.12 or later, which contains fixes for this OS command injection vulnerability.

Firmware version 2.5.12 also includes other improvements such as VPN optimization, Wake-on-LAN enhancements, accessibility improvements, and network-wide ad blocking.

Users should download the latest firmware and release notes from the official Cudy download center.

Useful 0 Not Useful 0