Command Injection Vulnerability in Cudy TR3000 by Cudy

CVE-2026-75487

What is CVE-2026-75487?

The Cudy TR3000 router firmware versions prior to 2.5.42 contain a command injection vulnerability that allows authenticated administrators to execute arbitrary commands with root privileges. This exploitation occurs through the WireGuard server configuration, specifically when the private_key option is improperly validated. An attacker can submit a private key using command substitution ($()), which is executed during the configuration export process by the action_wireguards_export() function passing the key to luci.sys.exec. This vulnerability poses serious risks to the integrity and confidentiality of the device's network operations.

References