Stack Buffer Overflow in Cudy TR3000 Router

CVE-2026-75488

What is CVE-2026-75488?

A stack buffer overflow vulnerability exists in the CWMP client of Cudy TR3000 routers prior to version 2.5.42. This flaw allows attackers with control of an Auto Configuration Server (ACS) to exploit oversized credentials, leading to potential stack memory corruption. By delivering TR-069 Download or Upload requests with Username and Password values up to 256 bytes, attackers can overflow the 128-byte stack buffers, resulting in the CWMP process crashing. This vulnerability poses risks to network integrity and may provide unauthorized access if left unaddressed.

References