dnsmasq Configuration Injection in Cudy TR3000 Routers
CVE-2026-129104

7HIGH

Key Information:

Vendor

Shenzhen Cudy Technology Co., Ltd.

Status
Tr3000 1.0
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129104?

The Cudy TR3000 router software versions prior to 2.5.42 are susceptible to a dnsmasq configuration injection vulnerability. This flaw permits authenticated administrators to exploit the net.set_dhcp leasetime field by embedding newlines, which can lead to unauthorized DNS manipulation. Attackers could leverage this weakness to alter DNS responses for local network clients or insert corrupted configuration lines that disrupt dnsmasq's functionality, impacting overall network performance and security. Users are advised to upgrade to version 2.5.42 or later to mitigate this risk.

Affected Version(s)

TR3000 1.0 0 < 2.5.42

TR3000 1.0 2.5.42

References

https://www.cudy.com/en-us/pages/download-center/tr3000-1-0
release-notes
https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_up...
patch
https://www.vulncheck.com/advisories/cudy-tr3000-before-2...
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.