{"id":"CVE-2026-75493","kind":"vulnerability","aliases":["CVE-2026-75493"],"related":[],"title":"Cudy TR3000 router: stack overflow in TR-069 parameter read crashes device","description":"Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service.","summary":"Cudy TR3000 routers before 2.5.42 have a stack buffer overflow in the obuspa TR-069 agent when reading the Wi-Fi KeyPassphrase parameter. A malicious or compromised management server (ACS) can set an oversized passphrase and crash the agent, causing denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy","embedded","infrastructure","router","tr-069","tr3000"],"not_affected_if":["firmware-2.5.42-or-later","no-tr-069-acs"],"how_to_check":"- Check the firmware version on the router's admin page; versions below `2.5.42` are affected.\n- Check whether TR-069 / remote management (ACS) is enabled in the router's settings.","fix":"- Cudy TR3000: firmware `2.5.42` or later (per the description of the affected range).","status":"open","published_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:51:19+00:00","updated_at":"2026-11-13T10:51:19+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:51:19Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: firmware `2.5.42` or later (per the description of the affected range).","reach":"network","title":"Cudy TR3000 router: stack overflow in TR-069 parameter read crashes device","impact":"low","summary":"Cudy TR3000 routers before 2.5.42 have a stack buffer overflow in the obuspa TR-069 agent when reading the Wi-Fi KeyPassphrase parameter. A malicious or compromised management server (ACS) can set an oversized passphrase and crash the agent, causing denial of service.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy","tr3000","router","tr-069","embedded"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Obuspa agent crashes, causing router management denial of service","analyst_note":"Remote-code-execution potential is not stated; check the vulncheck advisory for exploitability.\n","how_to_check":"- Check the firmware version on the router's admin page; versions below `2.5.42` are affected.\n- Check whether TR-069 / remote management (ACS) is enabled in the router's settings.","plain_action":"Update your Cudy TR3000 router firmware to 2.5.42 or later in its admin settings.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-tr-069-acs"],"who_is_affected":"Cudy TR3000 routers running firmware before 2.5.42 that are managed through a TR-069 ACS. The exposure comes from the management server path, so routers with remote management turned off are less exposed. The sources do not say how the ACS is reached, so the exact trigger conditions are unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000785,"input_tokens":4650,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-069':8A,24B,40B '-098':87C '-2026':14A,17A '-75493':15A,18A '000':118C '096':101C '2.5.42':30B,73C '4':100C '5':117C 'ac':56B,113C 'agent':41B,65B 'buffer':34B,77C,104C,132C 'byte':102C,119C 'caus':66B,136C 'check':108C 'compromis':53B,112C 'contain':74C 'copi':92C 'crash':11A,63B,134C 'cudi':1A,19B,26B,70C 'cve':13A,16A 'denial':67B,137C 'devic':12A 'embed':20B 'fi':47B 'getter':83C 'infrastructur':21B 'keypassphras':48B,89C 'later':125C 'length':107C 'malici':51B,110C 'manag':54B 'obuspa':38B,82C,135C 'overflow':5A,35B,78C,130C 'overs':60B 'paramet':9A,49B,90C,129C 'passphras':61B,120C 'read':10A,43B,126C 'router':3A,22B,28B 'server':55B 'servic':69B,139C 'set':58B,115C 'setparametervalu':122C 'stack':4A,33B,76C,103C 'store':94C 'strcpi':97C 'tr':7A,23B,39B,86C 'tr3000':2A,25B,27B,71C 'valu':95C 'via':121C 'vulner':79C 'wi':46B 'wi-fi':45B 'without':105C 'wlanconfigur':88C","nicknames":[],"mitigations":[],"who_affected":"Cudy TR3000 routers running firmware before 2.5.42 that are managed through a TR-069 ACS. The exposure comes from the management server path, so routers with remote management turned off are less exposed. The sources do not say how the ACS is reached, so the exact trigger conditions are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router firmware to 2.5.42 or later in its admin settings.","pkeys":[],"ptokens":[],"labels":["cudy","embedded","high","infrastructure","router","tr069","tr3000"],"campaign_type":null,"search_a":"'-069':8A '-2026':14A,17A '-75493':15A,18A 'crash':11A 'cudi':1A 'cve':13A,16A 'devic':12A 'overflow':5A 'paramet':9A 'read':10A 'router':3A 'stack':4A 'tr':7A 'tr3000':2A","search_b":"'-069':24B,40B '2.5.42':30B 'ac':56B 'agent':41B,65B 'buffer':34B 'caus':66B 'compromis':53B 'crash':63B 'cudi':19B,26B 'denial':67B 'embed':20B 'fi':47B 'infrastructur':21B 'keypassphras':48B 'malici':51B 'manag':54B 'obuspa':38B 'overflow':35B 'overs':60B 'paramet':49B 'passphras':61B 'read':43B 'router':22B,28B 'server':55B 'servic':69B 'set':58B 'stack':33B 'tr':23B,39B 'tr3000':25B,27B 'wi':46B 'wi-fi':45B","search_c":"'-098':87C '000':118C '096':101C '2.5.42':73C '4':100C '5':117C 'ac':113C 'buffer':77C,104C,132C 'byte':102C,119C 'caus':136C 'check':108C 'compromis':112C 'contain':74C 'copi':92C 'crash':134C 'cudi':70C 'denial':137C 'getter':83C 'keypassphras':89C 'later':125C 'length':107C 'malici':110C 'obuspa':82C,135C 'overflow':78C,130C 'paramet':90C,129C 'passphras':120C 'read':126C 'servic':139C 'set':115C 'setparametervalu':122C 'stack':76C,103C 'store':94C 'strcpi':97C 'tr':86C 'tr3000':71C 'valu':95C 'via':121C 'vulner':79C 'without':105C 'wlanconfigur':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75493","severity":null,"published_at":"2026-11-13T10:18:16+00:00","modified_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145505,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-stack-buffer-overflow-via-obuspa-keypassphrase-getter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}