Argument Injection Vulnerability in Cudy TR3000 Router

CVE-2026-75494

What is CVE-2026-75494?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to an argument injection vulnerability. This flaw allows attackers to exploit unfiltered Username and Password inputs in the easycwmpd Upload handler, enabling the injection of curl options into the root-run curl command. By inserting whitespace, malicious actors can control critical HTTP response behaviors, writing authenticated data to arbitrary files on the device, potentially compromising system integrity and access.

References