{"id":"CVE-2026-75495","kind":"vulnerability","aliases":["CVE-2026-75495"],"related":[],"title":"Cudy TR3000 router: malicious management server runs commands as root","description":"Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.","summary":"Cudy TR3000 routers before 2.5.42 let a malicious or compromised ACS (TR-069 management server) run shell commands as root through a crafted password value in SetParameterValues requests. An attacker who controls or hijacks the management server gets full root control of the router.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cudy TR3000","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cudy-tr3000","home-router","infrastructure","tr-069"],"not_affected_if":["firmware-2.5.42-or-later","tr-069-disabled"],"how_to_check":"- Check the firmware version in the router's web admin page (System or Status) and compare it with `2.5.42`.\n- Check whether TR-069 remote management (obuspa, ACS URL) is enabled in the router's settings.","fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","status":"open","published_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","triaged_at":"2026-11-13T10:48:27+00:00","updated_at":"2026-11-13T10:48:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:48:27Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: malicious management server runs commands as root","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let a malicious or compromised ACS (TR-069 management server) run shell commands as root through a crafted password value in SetParameterValues requests. An attacker who controls or hijacks the management server gets full root control of the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","tr-069","home-router"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs commands as root on the router","analyst_note":"Confirm whether TR-069 is enabled by default on TR3000 and whether the ACS channel is reachable from the internet; check the vendor's advisory for the fixed version wording.","how_to_check":"- Check the firmware version in the router's web admin page (System or Status) and compare it with `2.5.42`.\n- Check whether TR-069 remote management (obuspa, ACS URL) is enabled in the router's settings.","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","product_name":"Cudy TR3000","needs_analyst":true,"not_affected_if":["firmware-2.5.42-or-later","tr-069-disabled"],"who_is_affected":"Routers running Cudy TR3000 firmware before 2.5.42 with TR-069 remote management enabled are exposed, since the flaw is reached through the management server's SetParameterValues requests. Devices with remote management disabled or without an ACS configured are much less exposed; the sources do not say whether the default configuration has TR-069 on.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0008,"input_tokens":4620,"output_tokens":676,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-069':27B,40B '-2026':12A,15A '-75495':13A,16A '2.5.42':32B,75C 'ac':38B,88C 'allow':83C 'attack':57B,102C 'command':8A,45B,79C,91C,117C,121C 'compromis':37B,87C 'concaten':113C 'contain':76C 'control':59B,68B 'craft':50B,97C 'cudi':1A,20B,28B,72C 'cudy':17A 'cudy-tr3000':19B 'cve':11A,14A 'execut':90C,122C 'full':66B 'gain':119C 'get':65B 'hijack':61B 'home':23B 'home-rout':22B 'infrastructur':25B 'inject':80C 'internetgatewaydevice.user':98C 'let':33B 'luci.util.exec':116C 'malici':4A,35B,85C 'manag':5A,41B,63B 'metacharact':110C 'obuspa_system.lua':112C 'os':78C 'password':51B,100C 'request':55B,107C 'root':10A,47B,67B,93C,120C 'router':3A,24B,30B,71B 'run':7A,43B 'send':104C 'server':6A,42B,64B 'setparametervalu':54B,106C 'shell':44B,109C 'string':118C 'suppli':95C 'tr':26B,39B 'tr3000':2A,18A,21B,29B,73C 'valu':52B,101C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Routers running Cudy TR3000 firmware before 2.5.42 with TR-069 remote management enabled are exposed, since the flaw is reached through the management server's SetParameterValues requests. Devices with remote management disabled or without an ACS configured are much less exposed; the sources do not say whether the default configuration has TR-069 on.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","pkeys":["cudytr3000","tr3000"],"ptokens":["cudy","tr3000"],"labels":["critical","cudytr3000","homerouter","infrastructure","tr069","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-75495':13A,16A 'command':8A 'cudi':1A 'cudy':17A 'cve':11A,14A 'malici':4A 'manag':5A 'root':10A 'router':3A 'run':7A 'server':6A 'tr3000':2A,18A","search_b":"'-069':27B,40B '2.5.42':32B 'ac':38B 'attack':57B 'command':45B 'compromis':37B 'control':59B,68B 'craft':50B 'cudi':20B,28B 'cudy-tr3000':19B 'full':66B 'get':65B 'hijack':61B 'home':23B 'home-rout':22B 'infrastructur':25B 'let':33B 'malici':35B 'manag':41B,63B 'password':51B 'request':55B 'root':47B,67B 'router':24B,30B,71B 'run':43B 'server':42B,64B 'setparametervalu':54B 'shell':44B 'tr':26B,39B 'tr3000':21B,29B 'valu':52B","search_c":"'2.5.42':75C 'ac':88C 'allow':83C 'attack':102C 'command':79C,91C,117C,121C 'compromis':87C 'concaten':113C 'contain':76C 'craft':97C 'cudi':72C 'execut':90C,122C 'gain':119C 'inject':80C 'internetgatewaydevice.user':98C 'luci.util.exec':116C 'malici':85C 'metacharact':110C 'obuspa_system.lua':112C 'os':78C 'password':100C 'request':107C 'root':93C,120C 'send':104C 'setparametervalu':106C 'shell':109C 'string':118C 'suppli':95C 'tr3000':73C 'valu':101C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75495","severity":null,"published_at":"2026-11-13T10:18:17+00:00","modified_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","fetched_at":"2026-11-13T10:47:36+00:00","note":null}],"documents":[{"id":145507,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-os-command-injection-via-tr-098-user-password-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}