---
id: "CVE-2026-129104"
page: "https://infrastack.ai/live/CVE-2026-129104"
kind: "vulnerability"
aliases: ["CVE-2026-129104"]
title: "Cudy TR3000 router: authenticated admin can inject dnsmasq DNS directives"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Cudy TR3000", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cudy-tr3000", "dnsmasq", "infrastructure", "router", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-11-13T16:19:00+00:00"
first_seen_at: "2026-11-13T16:47:34+00:00"
updated_at: "2026-11-13T16:48:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129104", "first_seen_at": "2026-11-13T16:47:34+00:00"}]
exploit_sources: []
---

# Cudy TR3000 router: authenticated admin can inject dnsmasq DNS directives

Link for people: https://infrastack.ai/live/CVE-2026-129104 (this .md is for agents)

Cudy TR3000 routers before 2.5.42 let a logged-in administrator embed a newline in the DHCP lease time setting, which writes extra dnsmasq directives. An attacker with admin access can then change DNS answers for devices on the LAN or make dnsmasq fail to start.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cudy TR3000 affected range not listed fixed no fixed version listed

## How to check

- Log in to the router admin page and check the firmware version in the system status page.
- Confirm whether the router firmware is below `2.5.42`.

## Fix

- Cudy TR3000: move to `2.5.42` or later.

## Timeline

- 2026-11-13T16:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129104

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-dnsmasq-configuration-injection-via-net-set-dhcp

## From the sources

Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_