CVE-2026-75493 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 have a stack buffer overflow in the obuspa TR-069 agent when reading the Wi-Fi KeyPassphrase parameter. A malicious or compromised management server (ACS) can set an oversized passphrase and crash the agent, causing denial of service.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Cudy TR3000 routers running firmware before 2.5.42 that are managed through a TR-069 ACS. The exposure comes from the management server path, so routers with remote management turned off are less exposed. The sources do not say how the ACS is reached, so the exact trigger conditions are unknown.
Not affected if firmware-2.5.42-or-later, no-tr-069-acs
Who cares cudy, embedded, router, tr-069, tr3000
2.5.42 are affected.2.5.42 or later (per the description of the affected range).Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.