Shenzhen Cudy Technology vulnerabilities
We track 18 vulnerabilities in Shenzhen Cudy Technology products across 4 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Shenzhen Cudy Technology vulnerabilities
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, w
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftu
- 7.2 High severity
TR3000 1.0: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns obj
- 7.2 High severity
TR3000 1.0: Improper Encoding or Escaping of Output
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject di
- 7.2 High severity
TR3000 1.0: Incomplete List of Disallowed Inputs
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the inc
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.exe
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration fi
- 8.1 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues reques
- 7.4 High severity
TR3000 1.0: Improper Neutralization of Argument Delimiters in a Command
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add opti
- 7.5 High severity
TR3000 1.0: Stack-based Buffer Overflow
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram la
- 8.1 High severity
TR3000 1.0: Improper Verification of Cryptographic Signature
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 88
- 7.5 High severity
TR3000 1.0: Missing Authentication for Critical Functionality
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycma
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which r
- 8.1 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues r
- 8.8 High severity
WR3000 2.0: Improper Neutralization of Special Elements used in an OS Command
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sy
- 9.1 Critical severity
WR3000 2.0: Use of Hard-coded Credentials
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the fi
- 8.8 High severity
LT300 3.0: Improper Neutralization of Special Elements used in an OS Command
Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the sy