{"id":"CVE-2026-75492","kind":"vulnerability","aliases":["CVE-2026-75492"],"related":[],"title":"Cudy TR3000 router: unauthenticated UDP packet overflows stack, crashes service","description":"Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service.","summary":"Cudy TR3000 routers before firmware 2.5.42 have a stack buffer overflow in the stun_client TR-111 UDP connection request parser. A single crafted UDP datagram sent without authentication can overflow a 10-byte stack buffer and crash stun_client, causing denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy-tr3000","home-router","infrastructure","tr-069"],"not_affected_if":["firmware-2.5.42-or-later","stun-client-disabled"],"how_to_check":"- Check the firmware version on the router's admin page; versions below `2.5.42` are in the stated range\n- Check whether TR-069/TR-111 connection request handling (stun_client) is enabled on the device","fix":"- Cudy TR3000: upgrade to firmware `2.5.42` or later","status":"open","published_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:49:08+00:00","updated_at":"2026-11-13T10:49:08+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:49:08Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: upgrade to firmware `2.5.42` or later","reach":"internet","title":"Cudy TR3000 router: unauthenticated UDP packet overflows stack, crashes service","impact":"low","summary":"Cudy TR3000 routers before firmware 2.5.42 have a stack buffer overflow in the stun_client TR-111 UDP connection request parser. A single crafted UDP datagram sent without authentication can overflow a 10-byte stack buffer and crash stun_client, causing denial of service.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","home-router","tr-069"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote crash of stun_client, denial of service; code execution not stated","analyst_note":"","how_to_check":"- Check the firmware version on the router's admin page; versions below `2.5.42` are in the stated range\n- Check whether TR-069/TR-111 connection request handling (stun_client) is enabled on the device","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","stun-client-disabled"],"who_is_affected":"Cudy TR3000 routers running firmware before 2.5.42 that expose the stun_client TR-111 UDP connection request service. The parser runs before any username or HMAC check, so an unauthenticated remote sender can reach it over UDP. Owners of routers on updated firmware, or with the service unreachable from outside, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4626,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-069':25B '-111':42B,86C '-2026':12A,15A '-75492':13A,16A '10':58B,120C '2.5.42':31B,73C 'attack':100C 'authent':54B 'buffer':35B,61B,78C,123C 'byte':59B,121C 'caus':66B,115C 'client':40B,65B,84C,127C 'connect':44B,88C 'contain':74C 'craft':49B,105C 'crash':9A,63B,125C 'cudi':1A,18B,26B,70C 'cudy-tr3000':17B 'cve':11A,14A 'datagram':51B,107C 'denial':67B,129C 'firmwar':30B 'hmac':98C 'home':21B 'home-rout':20B 'infrastructur':23B 'lack':108C 'line':114C 'overflow':7A,36B,56B,79C,118C 'packet':6A 'pars':92C 'parser':46B,90C 'remot':99C 'request':45B,89C,93C,113C 'router':3A,22B,28B 'send':102C 'sent':52B 'servic':10A,69B,131C 'singl':48B,104C 'space':110C 'stack':8A,34B,60B,77C,122C 'strncpi':116C 'stun':39B,64B,83C,126C 'tr':24B,41B,85C 'tr3000':2A,19B,27B,71C 'udp':5A,43B,50B,87C,106C 'unauthent':4A,76C 'usernam':96C 'verifi':95C 'vulner':80C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Cudy TR3000 routers running firmware before 2.5.42 that expose the stun_client TR-111 UDP connection request service. The parser runs before any username or HMAC check, so an unauthenticated remote sender can reach it over UDP. Owners of routers on updated firmware, or with the service unreachable from outside, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","pkeys":[],"ptokens":[],"labels":["cudytr3000","high","homerouter","infrastructure","tr069"],"campaign_type":null,"search_a":"'-2026':12A,15A '-75492':13A,16A 'crash':9A 'cudi':1A 'cve':11A,14A 'overflow':7A 'packet':6A 'router':3A 'servic':10A 'stack':8A 'tr3000':2A 'udp':5A 'unauthent':4A","search_b":"'-069':25B '-111':42B '10':58B '2.5.42':31B 'authent':54B 'buffer':35B,61B 'byte':59B 'caus':66B 'client':40B,65B 'connect':44B 'craft':49B 'crash':63B 'cudi':18B,26B 'cudy-tr3000':17B 'datagram':51B 'denial':67B 'firmwar':30B 'home':21B 'home-rout':20B 'infrastructur':23B 'overflow':36B,56B 'parser':46B 'request':45B 'router':22B,28B 'sent':52B 'servic':69B 'singl':48B 'stack':34B,60B 'stun':39B,64B 'tr':24B,41B 'tr3000':19B,27B 'udp':43B,50B 'without':53B","search_c":"'-111':86C '10':120C '2.5.42':73C 'attack':100C 'buffer':78C,123C 'byte':121C 'caus':115C 'client':84C,127C 'connect':88C 'contain':74C 'craft':105C 'crash':125C 'cudi':70C 'datagram':107C 'denial':129C 'hmac':98C 'lack':108C 'line':114C 'overflow':79C,118C 'pars':92C 'parser':90C 'remot':99C 'request':89C,93C,113C 'send':102C 'servic':131C 'singl':104C 'space':110C 'stack':77C,122C 'strncpi':116C 'stun':83C,126C 'tr':85C 'tr3000':71C 'udp':87C,106C 'unauthent':76C 'usernam':96C 'verifi':95C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75492","severity":null,"published_at":"2026-11-13T10:18:16+00:00","modified_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145504,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-stun-client-udp-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}