CVE-2026-75487

Description

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.6CVSS 4.0, Highfrom the CNA (VulnCheck)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• 7.2CVSS 3.1, Highfrom the CNA (VulnCheck)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-78

References

• Cudy TR3000 1.0 Download Centerrelease-notes
• Cudy TR3000 Firmware 2.5.42patch
• VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Exportthird-party-advisory