CVE-2026-126953

Name of the Vulnerable Software and Affected Versions Cudy TR3000 versions prior to 2.5.42

Description An OS command injection flaw exists where a malicious or compromised Auto Configuration Server (ACS) can execute commands with root privileges. This occurs when the set UserUsername() function in obuspa system.lua passes an unvalidated InternetGatewayDevice.User.{i}.Username value to os.execute(). An attacker can trigger this by sending a SetParameterValues request containing shell metacharacters.

Recommendations Update Cudy TR3000 to version 2.5.42.