CVE-2026-75494 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers running firmware before 2.5.42 pass unfiltered Username and Password values from the ACS management server into a root-run curl command in the easycwmpd Upload handler. A malicious or compromised ACS can inject curl options such as -o and --url, writing attacker-controlled HTTP responses to arbitrary files on the device.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only routers that receive configuration from a TR-069 ACS through easycwmpd are exposed, since the attacker must control the ACS or its credentials. Routers managed purely through the local admin page with no ACS are unlikely to be affected. Teams running managed Cudy fleets should update to 2.5.42 or later.
Not affected if firmware-2.5.42-or-later, no-acs
Who cares cudy, easycwmpd, openwrt, tr-069, tr3000
2.5.42.2.5.42 or later.Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.