EUVD-2026-125263

Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-by...

CVE-2026-75495

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an OS command injection vulnerability via the TR-098 User Password Parameter . A malicious or compromised ACS can send a SetParameterValues request containing shell metacharacters in the InternetGatewayDevice.User.{i}.Password value. Thes...

CVE-2026-126953

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an OS command injection flaw. A malicious or compromised ACS can execute commands as root by sending a SetParameterValues request containing shell metacharacters in the InternetGatewayDevice.User.{i}.Username value. The vulnerability occu...