Remote Code Execution Vulnerability in Cudy TR3000 Products

CVE-2026-75490

What is CVE-2026-75490?

The Cudy TR3000 device prior to version 2.5.42 is susceptible to a remote code execution vulnerability. This flaw allows unauthorized adjacent attackers to execute arbitrary root commands by utilizing a malicious automesh controller advertised through mDNS. Attackers can pose as legitimate devices on the local network, sending encrypted commands to the vulnerable router that are executed as root by the device. This may lead to significant security breaches, as it allows attackers to manipulate the device without authentication.

References