EUVD-2026-125445

Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.setdhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN...

CVE-2026-129104

The Cudy TR3000 (versions before 2.5.42 ) is susceptible to a dnsmasq configuration injection vulnerability (CWE-93). Authenticated administrators can inject arbitrary directives by embedding a newline character into the net.set_dhcp leasetime field. This allows attackers to append address= entri...