Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126953 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution. | ||||
| CVE-2026-75578 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root. | ||||
| CVE-2026-75577 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command. | ||||
| CVE-2026-75576 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c. | ||||
| CVE-2026-75495 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution. | ||||
| CVE-2026-75494 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.4 High |
| Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device. | ||||
| CVE-2026-75493 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 5.9 Medium |
| Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service. | ||||
| CVE-2026-75492 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.5 High |
| Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service. | ||||
| CVE-2026-75491 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root. | ||||
| CVE-2026-75490 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.5 High |
| Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root. | ||||
| CVE-2026-75489 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 6.8 Medium |
| Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points. | ||||
| CVE-2026-75488 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 5.9 Medium |
| Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process. | ||||
| CVE-2026-75487 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export. | ||||
| CVE-2026-129105 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 6.5 Medium |
| Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process. | ||||
| CVE-2026-129104 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 6.5 Medium |
| Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq. | ||||
| CVE-2026-129103 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run. | ||||
| CVE-2026-129102 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA. | ||||
| CVE-2026-129101 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root. | ||||
| CVE-2026-129100 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root. | ||||
| CVE-2026-129099 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 7.2 High |
| Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint. | ||||
Page 1 of 1.