Command Injection Vulnerability in Cudy TR3000 Router

CVE-2026-75576

What is CVE-2026-75576?

The Cudy TR3000 router, prior to version 2.5.42, is affected by a command injection vulnerability. This flaw permits authenticated administrators to execute arbitrary commands as root by leveraging an unvalidated multipart filename in the CBI FileUpload handler. Specifically, attackers can exploit the system by uploading a crafted OpenVPN configuration file through the VPN client configuration page. This filename can include shell command substitution syntax, which is then executed on the device, potentially leading to unauthorized access and control over the router.

References