OS Command Injection in Cudy TR3000 Router

CVE-2026-126953

What is CVE-2026-126953?

The Cudy TR3000 router is susceptible to an OS command injection vulnerability that could allow a threat actor to execute arbitrary commands with root privileges. This vulnerability arises from the improper handling of an unvalidated 'InternetGatewayDevice.User.{i}.Username' value, which can be exploited through a specially crafted SetParameterValues request containing shell metacharacters. Attackers leveraging this flaw can make unauthorized modifications, potentially compromising the entire system. It is crucial for users to update their Cudy TR3000 routers to the latest firmware version, 2.5.42 or later, to mitigate this risk.

References