{"id":"CVE-2026-75490","kind":"vulnerability","aliases":["CVE-2026-75490"],"related":[],"title":"Cudy TR3000 router: rogue mDNS controller lets adjacent attackers run root commands","description":"Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.","summary":"Cudy TR3000 routers before 2.5.42 accept commands from a rogue automesh controller that an attacker advertises over mDNS on the local Ethernet segment. The attacker gets remote code execution as root on the router without logging in.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cudy TR3000","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["automesh","cudy-tr3000","home-router","infrastructure","mdns"],"not_affected_if":["firmware-2.5.42-or-later","no-untrusted-ethernet-segment"],"how_to_check":"- Check the firmware version on the router's admin page and compare it with `2.5.42`.","fix":"- Cudy TR3000: move to `2.5.42` or later.","status":"open","published_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:52:28+00:00","updated_at":"2026-11-13T10:52:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:52:28Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: rogue mDNS controller lets adjacent attackers run root commands","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 accept commands from a rogue automesh controller that an attacker advertises over mDNS on the local Ethernet segment. The attacker gets remote code execution as root on the router without logging in.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","home-router","mdns","automesh"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs root commands on the router from the local network.","analyst_note":"","how_to_check":"- Check the firmware version on the router's admin page and compare it with `2.5.42`.\n- unknown for any further file or setting checks; the sources do not say.","plain_action":"Update your Cudy TR3000 router firmware to 2.5.42 or later.","product_name":"Cudy TR3000","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-untrusted-ethernet-segment"],"who_is_affected":"Cudy TR3000 routers running firmware before 2.5.42 are exposed to any device on the upstream Ethernet segment that can send mDNS traffic. The flaw is reached through the automesh controller discovery path, so a router not using automesh discovery on an untrusted segment is less exposed. Systems behind a trusted local network with no untrusted devices can deprioritise it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4629,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-75490':15A,18A '2.5.42':34B,69C 'accept':35B 'adjac':8A,79C 'advertis':45B,86C,100C 'ae':116C 'allow':77C 'attack':9A,44B,54B,80C,93C 'automesh':21B,40B,89C 'broker':108C 'code':57B,73C 'command':12A,36B,84C,111C 'contain':70C 'control':6A,41B,90C 'cudi':1A,23B,30B,66C 'cudy':19A 'cudy-tr3000':22B 'cudycmagent._tcp':101C 'cve':13A,16A 'encrypt':112C 'ethernet':51B,97C 'execut':58B,74C,120C 'fix':115C 'get':55B 'home':26B 'home-rout':25B 'infrastructur':28B 'key':117C 'let':7A 'local':50B 'log':65B 'malici':106C 'mdns':5A,29B,47B,92C 'mqtt':107C 'point':103C 'record':102C 'remot':56B,72C 'rogu':4A,39B,88C 'root':11A,60B,83C,122C 'router':3A,27B,32B,63B 'router/batchcmd.lua':119C 'run':10A,82C 'segment':52B,98C 'send':110C 'tr3000':2A,20A,24B,31B,67C 'unauthent':78C 'upstream':96C 'vulner':75C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Cudy TR3000 routers running firmware before 2.5.42 are exposed to any device on the upstream Ethernet segment that can send mDNS traffic. The flaw is reached through the automesh controller discovery path, so a router not using automesh discovery on an untrusted segment is less exposed. Systems behind a trusted local network with no untrusted devices can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router firmware to 2.5.42 or later.","pkeys":["cudytr3000","tr3000"],"ptokens":["cudy","tr3000"],"labels":["automesh","cudytr3000","high","homerouter","infrastructure","mdns","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-75490':15A,18A 'adjac':8A 'attack':9A 'command':12A 'control':6A 'cudi':1A 'cudy':19A 'cve':13A,16A 'let':7A 'mdns':5A 'rogu':4A 'root':11A 'router':3A 'run':10A 'tr3000':2A,20A","search_b":"'2.5.42':34B 'accept':35B 'advertis':45B 'attack':44B,54B 'automesh':21B,40B 'code':57B 'command':36B 'control':41B 'cudi':23B,30B 'cudy-tr3000':22B 'ethernet':51B 'execut':58B 'get':55B 'home':26B 'home-rout':25B 'infrastructur':28B 'local':50B 'log':65B 'mdns':29B,47B 'remot':56B 'rogu':39B 'root':60B 'router':27B,32B,63B 'segment':52B 'tr3000':24B,31B 'without':64B","search_c":"'2.5.42':69C 'adjac':79C 'advertis':86C,100C 'ae':116C 'allow':77C 'attack':80C,93C 'automesh':89C 'broker':108C 'code':73C 'command':84C,111C 'contain':70C 'control':90C 'cudi':66C 'cudycmagent._tcp':101C 'encrypt':112C 'ethernet':97C 'execut':74C,120C 'fix':115C 'key':117C 'malici':106C 'mdns':92C 'mqtt':107C 'point':103C 'record':102C 'remot':72C 'rogu':88C 'root':83C,122C 'router/batchcmd.lua':119C 'run':82C 'segment':98C 'send':110C 'tr3000':67C 'unauthent':78C 'upstream':96C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75490","severity":null,"published_at":"2026-11-13T10:18:16+00:00","modified_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145502,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-unauthenticated-rce-via-mdns-automesh-broker-adoption","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}