{"id":"CVE-2026-75494","kind":"vulnerability","aliases":["CVE-2026-75494"],"related":[],"title":"Cudy TR3000 router: unfiltered credentials let attacker write arbitrary files","description":"Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.","summary":"Cudy TR3000 routers running firmware before 2.5.42 pass unfiltered Username and Password values from the ACS management server into a root-run curl command in the easycwmpd Upload handler. A malicious or compromised ACS can inject curl options such as -o and --url, writing attacker-controlled HTTP responses to arbitrary files on the device.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy","easycwmpd","infrastructure","openwrt","tr-069","tr3000"],"not_affected_if":["firmware-2.5.42-or-later","no-acs"],"how_to_check":"- Check the router's firmware version in its admin interface (System or Status page) and compare it with `2.5.42`.\n- Check whether the router is managed by a TR-069 ACS (easycwmpd is enabled).","fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","status":"open","published_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","triaged_at":"2026-11-13T10:51:02+00:00","updated_at":"2026-11-13T10:51:02+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:51:02Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: unfiltered credentials let attacker write arbitrary files","impact":"high","summary":"Cudy TR3000 routers running firmware before 2.5.42 pass unfiltered Username and Password values from the ACS management server into a root-run curl command in the easycwmpd Upload handler. A malicious or compromised ACS can inject curl options such as -o and --url, writing attacker-controlled HTTP responses to arbitrary files on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy","tr3000","tr-069","easycwmpd","openwrt"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"root-run curl writes attacker-controlled data to arbitrary device files","analyst_note":"","how_to_check":"- Check the router's firmware version in its admin interface (System or Status page) and compare it with `2.5.42`.\n- Check whether the router is managed by a TR-069 ACS (easycwmpd is enabled).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-acs","firmware-2.5.42-or-later"],"who_is_affected":"Only routers that receive configuration from a TR-069 ACS through easycwmpd are exposed, since the attacker must control the ACS or its credentials. Routers managed purely through the local admin page with no ACS are unlikely to be affected. Teams running managed Cudy fleets should update to 2.5.42 or later.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4611,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-069':22B '-2026':12A,15A '-75494':13A,16A '2.5.42':30B,83C 'ac':39B,58B,95C 'add':116C 'allow':90C 'arbitrari':9A,75B,136C 'argument':86C 'attack':7A,70B,111C,131C 'attacker-control':69B,130C 'command':48B,128C 'compromis':57B,94C 'contain':84C 'control':71B,132C 'credenti':5A 'cudi':1A,17B,24B,80C 'curl':47B,61B,98C,127C 'cve':11A,14A 'devic':79B,140C 'easycwmpd':18B,51B,108C 'emb':113C 'file':10A,76B,137C 'firmwar':28B 'handler':53B,110C 'http':72B,133C 'infrastructur':19B 'inject':60B,87C,97C 'let':6A 'like':118C 'malici':55B,92C 'manag':40B 'o':65B,119C 'openwrt':20B 'option':62B,99C,117C 'pass':31B 'password':35B,104C 'respons':73B,134C 'root':45B,125C 'root-run':44B,124C 'router':3A,26B 'run':27B,46B,126C 'server':41B 'tr':21B 'tr3000':2A,23B,25B,81C 'unfilt':4A,32B,101C 'upload':52B,109C 'url':67B,121C 'usernam':33B,102C 'valu':36B,105C 'vulner':88C 'whitespac':114C 'write':8A,68B,129C","nicknames":[],"mitigations":[],"who_affected":"Only routers that receive configuration from a TR-069 ACS through easycwmpd are exposed, since the attacker must control the ACS or its credentials. Routers managed purely through the local admin page with no ACS are unlikely to be affected. Teams running managed Cudy fleets should update to 2.5.42 or later.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cudy","easycwmpd","high","infrastructure","openwrt","tr069","tr3000"],"campaign_type":null,"search_a":"'-2026':12A,15A '-75494':13A,16A 'arbitrari':9A 'attack':7A 'credenti':5A 'cudi':1A 'cve':11A,14A 'file':10A 'let':6A 'router':3A 'tr3000':2A 'unfilt':4A 'write':8A","search_b":"'-069':22B '2.5.42':30B 'ac':39B,58B 'arbitrari':75B 'attack':70B 'attacker-control':69B 'command':48B 'compromis':57B 'control':71B 'cudi':17B,24B 'curl':47B,61B 'devic':79B 'easycwmpd':18B,51B 'file':76B 'firmwar':28B 'handler':53B 'http':72B 'infrastructur':19B 'inject':60B 'malici':55B 'manag':40B 'o':65B 'openwrt':20B 'option':62B 'pass':31B 'password':35B 'respons':73B 'root':45B 'root-run':44B 'router':26B 'run':27B,46B 'server':41B 'tr':21B 'tr3000':23B,25B 'unfilt':32B 'upload':52B 'url':67B 'usernam':33B 'valu':36B 'write':68B","search_c":"'2.5.42':83C 'ac':95C 'add':116C 'allow':90C 'arbitrari':136C 'argument':86C 'attack':111C,131C 'attacker-control':130C 'command':128C 'compromis':94C 'contain':84C 'control':132C 'cudi':80C 'curl':98C,127C 'devic':140C 'easycwmpd':108C 'emb':113C 'file':137C 'handler':110C 'http':133C 'inject':87C,97C 'like':118C 'malici':92C 'o':119C 'option':99C,117C 'password':104C 'respons':134C 'root':125C 'root-run':124C 'run':126C 'tr3000':81C 'unfilt':101C 'upload':109C 'url':121C 'usernam':102C 'valu':105C 'vulner':88C 'whitespac':114C 'write':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75494","severity":null,"published_at":"2026-11-13T10:18:17+00:00","modified_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","fetched_at":"2026-11-13T10:47:36+00:00","note":null}],"documents":[{"id":145506,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-curl-argument-injection-via-tr-069-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}