Command Injection Vulnerability in Cudy TR3000 Router
CVE-2026-129103

8.6HIGH

Key Information:

Vendor

Shenzhen Cudy Technology Co., Ltd.

Status
Tr3000 1.0
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129103?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to a command injection flaw. This vulnerability allows authenticated administrators to inject newlines into the 'reboot_time' setting. By doing so, attackers can introduce additional crontab entries, leading to unauthorized command execution with root privileges via the /etc/init.d/autoreboot process. This poses a significant security risk, potentially enabling malicious activities on affected devices.

Affected Version(s)

TR3000 1.0 0 < 2.5.42

TR3000 1.0 2.5.42

References

https://www.cudy.com/en-us/pages/download-center/tr3000-1-0
release-notes
https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_up...
patch
https://www.vulncheck.com/advisories/cudy-tr3000-before-2...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.