CUDY TR3000 · CVE-2026-75490 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 accept commands from a rogue automesh controller that an attacker advertises over mDNS on the local Ethernet segment. The attacker gets remote code execution as root on the router without logging in.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Cudy TR3000 routers running firmware before 2.5.42 are exposed to any device on the upstream Ethernet segment that can send mDNS traffic. The flaw is reached through the automesh controller discovery path, so a router not using automesh discovery on an untrusted segment is less exposed. Systems behind a trusted local network with no untrusted devices can deprioritise it.
Not affected if firmware-2.5.42-or-later, no-untrusted-ethernet-segment
Who cares automesh, cudy-tr3000, home-router, mdns
2.5.42.2.5.42 or later.Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.
This page as .md · .json · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.