CVE-2026-129103 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before firmware 2.5.42 let an authenticated administrator inject newlines into the reboot_time setting. The injected text is written to the root crontab, so commands run as root.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only devices running a Cudy TR3000 firmware older than 2.5.42 are exposed, and the attacker must already hold administrator credentials for the router's web interface. Routers used by a team or site as the network gateway are the ones to check; a device that cannot be reached by untrusted users is lower risk.
Not affected if firmware-2.5.42-or-later, no-admin-access-by-untrusted-users
Who cares cudy-tr3000, openwrt-based, routers, self-hosted
2.5.42.2.5.42 or later, per the advisory.Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.