{"id":"CVE-2026-129104","kind":"vulnerability","aliases":["CVE-2026-129104"],"related":[],"title":"Cudy TR3000 router: authenticated admin can inject dnsmasq DNS directives","description":"Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.","summary":"Cudy TR3000 routers before 2.5.42 let a logged-in administrator embed a newline in the DHCP lease time setting, which writes extra dnsmasq directives. An attacker with admin access can then change DNS answers for devices on the LAN or make dnsmasq fail to start.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cudy TR3000","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cudy-tr3000","dnsmasq","infrastructure","router","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Log in to the router admin page and check the firmware version in the system status page.\n- Confirm whether the router firmware is below `2.5.42`.","fix":"- Cudy TR3000: move to `2.5.42` or later.","status":"open","published_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:45+00:00","updated_at":"2026-11-13T16:48:45+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:45Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: authenticated admin can inject dnsmasq DNS directives","impact":"medium","summary":"Cudy TR3000 routers before 2.5.42 let a logged-in administrator embed a newline in the DHCP lease time setting, which writes extra dnsmasq directives. An attacker with admin access can then change DNS answers for devices on the LAN or make dnsmasq fail to start.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","dnsmasq","router","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin can redirect LAN DNS answers or crash dnsmasq","analyst_note":"Confirm the fixed firmware version and whether the vendor page names it; check the vulncheck advisory for exploit details and whether the LAN-only reach holds.","how_to_check":"- Log in to the router admin page and check the firmware version in the system status page.\n- Confirm whether the router firmware is below `2.5.42`.","plain_action":"","product_name":"Cudy TR3000","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Anyone running a Cudy TR3000 router with firmware before 2.5.42 is affected, since the flaw is in the router's dnsmasq configuration handling. Exploitation requires administrator credentials on the router, so exposure is limited to networks where admin access is not tightly controlled. Teams that do not run this router model can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4612,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129104':13A,16A '-2026':12A,15A '/etc/init.d/dnsmasq':107C '2.5.42':32B,77C 'access':57B 'address':104C 'admin':5A,56B 'administr':38B,87C 'allow':85C 'alter':109C 'answer':62B,111C 'append':103C 'attack':54B,101C 'authent':4A,86C 'chang':60B 'client':114C 'configur':81C 'contain':78C 'cudi':1A,20B,28B,74C 'cudy':17A 'cudy-tr3000':19B 'cve':11A,14A 'devic':64B 'dhcp':44B,98C 'direct':10A,52B,90C 'dns':9A,61B,110C 'dnsmasq':8A,22B,51B,70B,80C,121C 'emb':39B 'embed':92C 'entri':105C 'extra':50B 'fail':71B 'field':100C 'host':27B 'infrastructur':23B 'inject':7A,82C,89C 'insert':116C 'invalid':117C 'lan':67B,113C 'leas':45B 'leasetim':99C 'let':33B 'line':118C 'log':36B 'logged-in':35B 'make':69B 'net.set':97C 'newlin':41B,94C 'router':3A,24B,30B 'self':26B 'self-host':25B 'set':47B 'start':73B 'stop':120C 'time':46B 'tr3000':2A,18A,21B,29B,75C 'via':106C 'vulner':83C 'write':49B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Cudy TR3000 router with firmware before 2.5.42 is affected, since the flaw is in the router's dnsmasq configuration handling. Exploitation requires administrator credentials on the router, so exposure is limited to networks where admin access is not tightly controlled. Teams that do not run this router model can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cudytr3000","tr3000"],"ptokens":["cudy","tr3000"],"labels":["cudytr3000","dnsmasq","high","infrastructure","router","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129104':13A,16A '-2026':12A,15A 'admin':5A 'authent':4A 'cudi':1A 'cudy':17A 'cve':11A,14A 'direct':10A 'dns':9A 'dnsmasq':8A 'inject':7A 'router':3A 'tr3000':2A,18A","search_b":"'2.5.42':32B 'access':57B 'admin':56B 'administr':38B 'answer':62B 'attack':54B 'chang':60B 'cudi':20B,28B 'cudy-tr3000':19B 'devic':64B 'dhcp':44B 'direct':52B 'dns':61B 'dnsmasq':22B,51B,70B 'emb':39B 'extra':50B 'fail':71B 'host':27B 'infrastructur':23B 'lan':67B 'leas':45B 'let':33B 'log':36B 'logged-in':35B 'make':69B 'newlin':41B 'router':24B,30B 'self':26B 'self-host':25B 'set':47B 'start':73B 'time':46B 'tr3000':21B,29B 'write':49B","search_c":"'/etc/init.d/dnsmasq':107C '2.5.42':77C 'address':104C 'administr':87C 'allow':85C 'alter':109C 'answer':111C 'append':103C 'attack':101C 'authent':86C 'client':114C 'configur':81C 'contain':78C 'cudi':74C 'dhcp':98C 'direct':90C 'dns':110C 'dnsmasq':80C,121C 'embed':92C 'entri':105C 'field':100C 'inject':82C,89C 'insert':116C 'invalid':117C 'lan':113C 'leasetim':99C 'line':118C 'net.set':97C 'newlin':94C 'stop':120C 'tr3000':75C 'via':106C 'vulner':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129104","severity":null,"published_at":"2026-11-13T16:19:00+00:00","modified_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147662,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-dnsmasq-configuration-injection-via-net-set-dhcp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}