Stack Buffer Overflow Vulnerability in Cudy TR3000 Router

CVE-2026-75492

What is CVE-2026-75492?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to an unauthenticated stack buffer overflow vulnerability within its STUN client. This issue arises in the parser for TR-111 UDP Connection Requests, which processes incoming requests without first validating the username or HMAC. An attacker could exploit this vulnerability by sending a specially crafted UDP datagram, leading to a buffer overflow condition. This flaw may result in denial of service, causing the stun_client to crash. It is critical for users to update to the latest firmware version to mitigate this risk and safeguard their devices.

References