{"id":"CVE-2026-75577","kind":"vulnerability","aliases":["CVE-2026-75577"],"related":[],"title":"Cudy TR3000 router: authenticated admins run commands as root via WireGuard key","description":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.","summary":"Cudy TR3000 routers before 2.5.42 let an administrator store a WireGuard private key containing shell substitution, which is then passed to a shell command. An attacker with admin access can run arbitrary commands as root on the router.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy-tr3000","home-router","infrastructure","router","wireguard"],"not_affected_if":["firmware-2.5.42-or-later","no-admin-exposure"],"how_to_check":"- Check the firmware version in the router's web admin under System or Status; compare it with `2.5.42`.\n- Look for the vpn.export_conf method in requests to /cgi-bin/luci/rpc/app on the router, if you have logs.","fix":"- Cudy TR3000: move to firmware `2.5.42` or later (per the NVD range before 2.5.42).","status":"open","published_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","triaged_at":"2026-11-13T10:50:39+00:00","updated_at":"2026-11-13T10:50:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T10:50:39Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later (per the NVD range before 2.5.42).","reach":"network","title":"Cudy TR3000 router: authenticated admins run commands as root via WireGuard key","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an administrator store a WireGuard private key containing shell substitution, which is then passed to a shell command. An attacker with admin access can run arbitrary commands as root on the router.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","router","wireguard","home-router"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands as root on the router","analyst_note":"Product fields are empty in input; product_name supplied, verify ecosystem.","how_to_check":"- Check the firmware version in the router's web admin under System or Status; compare it with `2.5.42`.\n- Look for the vpn.export_conf method in requests to /cgi-bin/luci/rpc/app on the router, if you have logs.","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-admin-exposure"],"who_is_affected":"Only routers running firmware before 2.5.42 where someone already holds administrator login can use this flaw. Routers where only trusted admins have access and the firmware is current are not exposed to this flaw. The sources do not say whether WireGuard must be configured for the exploit path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4614,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-75577':15A,18A '/cgi-bin/luci/rpc/app':108C '2.5.42':32B,69C 'access':56B 'admin':5A,55B 'administr':35B,78C 'allow':76C 'arbitrari':59B 'attack':53B,91C 'authent':4A,77C 'call':101C 'command':7A,51B,60B,72C,81C,122C 'conf':104C 'contain':41B,70C,97C 'cudi':1A,20B,28B,66C 'cudy-tr3000':19B 'cve':13A,16A 'endpoint':112C 'execut':80C 'home':23B 'home-rout':22B 'infrastructur':25B 'inject':73C 'json':110C 'json-rpc':109C 'key':12A,40B,90C,96C,116C 'let':33B 'malici':87C 'method':105C 'pass':47B,114C 'privat':39B,89C,95C 'pubkey':120C 'root':9A,62B,83C 'router':3A,24B,26B,30B,65B 'rpc':111C 'run':6A,58B 'save':93C 'shell':42B,50B,98C,121C 'store':36B,85C 'substitut':43B,99C 'tr3000':2A,21B,29B,67C 'via':10A 'vpn.export':103C 'vulner':74C 'wg':119C 'wireguard':11A,27B,38B,88C","nicknames":[],"mitigations":[],"who_affected":"Only routers running firmware before 2.5.42 where someone already holds administrator login can use this flaw. Routers where only trusted admins have access and the firmware is current are not exposed to this flaw. The sources do not say whether WireGuard must be configured for the exploit path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","pkeys":[],"ptokens":[],"labels":["cudytr3000","high","homerouter","infrastructure","router","wireguard"],"campaign_type":null,"search_a":"'-2026':14A,17A '-75577':15A,18A 'admin':5A 'authent':4A 'command':7A 'cudi':1A 'cve':13A,16A 'key':12A 'root':9A 'router':3A 'run':6A 'tr3000':2A 'via':10A 'wireguard':11A","search_b":"'2.5.42':32B 'access':56B 'admin':55B 'administr':35B 'arbitrari':59B 'attack':53B 'command':51B,60B 'contain':41B 'cudi':20B,28B 'cudy-tr3000':19B 'home':23B 'home-rout':22B 'infrastructur':25B 'key':40B 'let':33B 'pass':47B 'privat':39B 'root':62B 'router':24B,26B,30B,65B 'run':58B 'shell':42B,50B 'store':36B 'substitut':43B 'tr3000':21B,29B 'wireguard':27B,38B","search_c":"'/cgi-bin/luci/rpc/app':108C '2.5.42':69C 'administr':78C 'allow':76C 'attack':91C 'authent':77C 'call':101C 'command':72C,81C,122C 'conf':104C 'contain':70C,97C 'cudi':66C 'endpoint':112C 'execut':80C 'inject':73C 'json':110C 'json-rpc':109C 'key':90C,96C,116C 'malici':87C 'method':105C 'pass':114C 'privat':89C,95C 'pubkey':120C 'root':83C 'rpc':111C 'save':93C 'shell':98C,121C 'store':85C 'substitut':99C 'tr3000':67C 'vpn.export':103C 'vulner':74C 'wg':119C 'wireguard':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75577","severity":null,"published_at":"2026-11-13T10:18:17+00:00","modified_at":"2026-11-13T10:18:17+00:00","first_seen_at":"2026-11-13T10:47:36+00:00","fetched_at":"2026-11-13T10:47:36+00:00","note":null}],"documents":[{"id":145509,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-export-conf-wireguard-private-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}