CVE-2026-126953

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an OS command injection flaw. A malicious or compromised ACS can execute commands as root by sending a SetParameterValues request containing shell metacharacters in the InternetGatewayDevice.User.{i}.Username value. The vulnerability occu...