CVE-2026-126953: High-Severity OS Command Injection in Cudy TR3000

## Overview Cudy Technology's TR3000 version 1.0 has a high-severity OS command injection vulnerability. This flaw allows attackers to execute commands as root. The vulnerability arises from an unvalidated input in the InternetGatewayDevice.User.{i}.Username value. ## Technical Details The vulnerability is triggered when an attacker sends a SetParameterValues request containing shell metacharacters. The function set_UserUsername() in obuspa_system.lua processes this input and passes it to os.execute(). This results in unauthorized command execution with root privileges. The CVSS score for this vulnerability is 9.2, indicating a critical risk level. ## Impact If exploited, this vulnerability could allow a malicious or compromised Automated Configuration Server (ACS) to gain full control over the affected device. This could lead to further attacks on the network or unauthorized access to sensitive information. ## Mitigation Defenders should immediately update Cudy TR3000 devices to version 2.5.42 or later to close this vulnerability. Regularly review device configurations and monitor for unusual activity to detect potential exploitation attempts.