OS Command Injection Vulnerability in Cudy TR3000 Router
CVE-2026-75495
9.2CRITICAL
Key Information:
- Status
- Vendor
- CVE Published:
- 13 November 2026
What is CVE-2026-75495?
The Cudy TR3000 router prior to version 2.5.42 is susceptible to an OS command injection vulnerability. This flaw allows attackers to exploit the device by sending a specially crafted SetParameterValues request. By supplying malicious input through the InternetGatewayDevice.User.{i}.Password parameter, which gets improperly handled by obuspa_system.lua, attackers can execute arbitrary commands with root privileges using the luci.util.exec() command. This security weakness underscores the importance of timely firmware updates to mitigate potential exploits.
Affected Version(s)
TR3000 1.0 0 < 2.5.42
TR3000 1.0 2.5.42