New High-Severity OS Command Injection Vulnerability in Cudy TR3000

## Overview Cudy Technology's TR3000 router has a high-severity OS command injection vulnerability identified as CVE-2026-75495. This flaw affects versions prior to 2.5.42. It allows attackers to execute commands as root by exploiting a specific parameter in the device's configuration. ## Technical Details The vulnerability arises from how the TR3000 processes the InternetGatewayDevice.User.{i}.Password value. Attackers can craft a malicious SetParameterValues request that includes shell metacharacters. The obuspa_system.lua script then concatenates these characters into a command string for luci.util.exec(). This results in unauthorized command execution with root privileges. ## Impact Successful exploitation of this vulnerability can lead to complete control over the affected device. Attackers could execute arbitrary commands, potentially compromising the entire network the device is connected to. Given the high CVSS score of 9.2, this vulnerability poses a significant risk to users of the Cudy TR3000. ## Mitigation Defenders should immediately update their Cudy TR3000 devices to version 2.5.42 or later to mitigate this vulnerability. Regularly check for firmware updates and apply security patches as they become available. Additionally, monitor network traffic for unusual activity that may indicate exploitation attempts.