{"id":"CVE-2026-75487","kind":"vulnerability","aliases":["CVE-2026-75487"],"related":[],"title":"Cudy TR3000 router: admin command injection gives root via WireGuard key","description":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator run commands as root by saving a WireGuard server private key containing shell command substitution. The key is passed unsanitised to a shell command during configuration export.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy-tr3000","infrastructure","openwrt-luci","routers","wireguard"],"not_affected_if":["auth-required","no-wireguard-server"],"how_to_check":"- Check the firmware version in the router's web admin under system status; versions below `2.5.42` are in the affected range.","fix":"- Cudy TR3000: move to `2.5.42` or later.","status":"open","published_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:50:42+00:00","updated_at":"2026-11-13T10:50:42+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:50:42Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: admin command injection gives root via WireGuard key","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator run commands as root by saving a WireGuard server private key containing shell command substitution. The key is passed unsanitised to a shell command during configuration export.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","wireguard","openwrt-luci","routers"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands as root on the router","analyst_note":"","how_to_check":"- Check the firmware version in the router's web admin under system status; versions below `2.5.42` are in the affected range.\n- unknown for anything beyond the version check, the sources do not say.","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","no-wireguard-server"],"who_is_affected":"Only routers with WireGuard server configured and an administrator account in use are exposed, since the attacker must be logged in as an admin. Routers with no WireGuard server set up, or where admin access is limited to trusted people, carry much less risk. The sources do not say which default configuration applies.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4583,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-75487':14A,17A '2.5.42':31B,66C 'action':100C 'admin':4A 'administr':35B,75C 'allow':73C 'attack':88C 'authent':34B,74C 'command':5A,37B,49B,59B,69C,78C,95C 'configur':61B,108C 'contain':47B,67C,94C 'cudi':1A,19B,27B,63C 'cudy-tr3000':18B 'cve':12A,15A 'execut':77C 'export':62B,102C,109C 'give':7A 'infrastructur':21B 'inject':6A,70C 'key':11A,46B,52B,86C,93C 'let':32B 'luci':24B 'luci.sys.exec':106C 'openwrt':23B 'openwrt-luci':22B 'option':87C 'pass':54B,103C 'privat':45B,85C,92C 'root':8A,39B,80C 'router':3A,25B,29B 'run':36B,98C 'save':41B,90C 'server':44B,84C 'shell':48B,58B 'substitut':50B,96C 'tr3000':2A,20B,28B,64C 'unsanitis':55B 'via':9A,81C 'vulner':71C 'wireguard':10A,26B,43B,83C,101C","nicknames":[],"mitigations":[],"who_affected":"Only routers with WireGuard server configured and an administrator account in use are exposed, since the attacker must be logged in as an admin. Routers with no WireGuard server set up, or where admin access is limited to trusted people, carry much less risk. The sources do not say which default configuration applies.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","pkeys":[],"ptokens":[],"labels":["cudytr3000","high","infrastructure","openwrtluci","routers","wireguard"],"campaign_type":null,"search_a":"'-2026':13A,16A '-75487':14A,17A 'admin':4A 'command':5A 'cudi':1A 'cve':12A,15A 'give':7A 'inject':6A 'key':11A 'root':8A 'router':3A 'tr3000':2A 'via':9A 'wireguard':10A","search_b":"'2.5.42':31B 'administr':35B 'authent':34B 'command':37B,49B,59B 'configur':61B 'contain':47B 'cudi':19B,27B 'cudy-tr3000':18B 'export':62B 'infrastructur':21B 'key':46B,52B 'let':32B 'luci':24B 'openwrt':23B 'openwrt-luci':22B 'pass':54B 'privat':45B 'root':39B 'router':25B,29B 'run':36B 'save':41B 'server':44B 'shell':48B,58B 'substitut':50B 'tr3000':20B,28B 'unsanitis':55B 'wireguard':26B,43B","search_c":"'2.5.42':66C 'action':100C 'administr':75C 'allow':73C 'attack':88C 'authent':74C 'command':69C,78C,95C 'configur':108C 'contain':67C,94C 'cudi':63C 'execut':77C 'export':102C,109C 'inject':70C 'key':86C,93C 'luci.sys.exec':106C 'option':87C 'pass':103C 'privat':85C,92C 'root':80C 'run':98C 'save':90C 'server':84C 'substitut':96C 'tr3000':64C 'via':81C 'vulner':71C 'wireguard':83C,101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75487","severity":null,"published_at":"2026-11-13T10:18:16+00:00","modified_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145499,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-wireguard-private-key-export","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}