CVE-2026-129103 in TR3000
Summary
by MITRE • 11/13/2026
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The Cudy TR3000 router software prior to version 2.5.42 suffers from a critical command injection vulnerability that compromises the integrity of the device's administrative interface. This flaw specifically affects authenticated administrators, allowing an attacker who has already obtained valid credentials for the web management portal to escalate privileges and execute arbitrary system commands with root-level permissions. The vulnerability resides in the handling of the reboot_time parameter within the router’s configuration logic. When a user submits this value through the web interface, the backend script located at /etc/init.d/autoreboot processes the input without adequate sanitization or validation. This lack of proper input filtering creates an opening for command injection attacks that can bypass standard access controls and result in full system compromise.
The technical mechanism behind this vulnerability involves the manipulation of newline characters within the reboot_time field. The backend script writes the provided value directly into a crontab file, which is then executed by the cron daemon to schedule automatic reboots at specified intervals. By appending a newline character followed by additional shell commands after the intended time value, an attacker can inject arbitrary lines into the root user’s crontab. Since the script executes with elevated privileges and writes directly to system-level configuration files without restricting the content format, any command injected in this manner will be executed by the cron daemon as the root user. This effectively grants the attacker persistent remote code execution capabilities on the device, allowing them to install backdoors, exfiltrate data, or pivot into other network segments depending on the router’s position within the infrastructure.
From an operational impact perspective, this vulnerability poses a severe risk to both home and small business networks relying on Cudy TR3000 routers for connectivity and security enforcement. Because authentication is required before exploitation can occur, the attack vector relies on credential theft or brute-force attacks against the administrative interface. However, once credentials are obtained, the ability to execute commands as root means that traditional perimeter defenses such as firewalls may be bypassed if the attacker modifies firewall rules via command injection. The persistence provided by crontab manipulation ensures that even if the initial exploit is detected and removed, malicious tasks can remain scheduled for future execution, complicating incident response efforts. This aligns with Common Weakness Enumeration CWE-78, which classifies improper neutralization of special elements used in an operating system command, commonly known as OS Command Injection.
The exploitation technique maps directly to the MITRE ATT&CK framework under T1053 Scheduled Task/Job, specifically the cron variant, and also relates to T1496 Remote Service Availability Disruption if the injected commands are designed to destabilize the device. Furthermore, because it involves authenticated users abusing input validation flaws, it falls under CWE-20 Improper Input Validation. The vulnerability highlights a common pitfall in embedded Linux devices where convenience features like automatic reboot scheduling are implemented with insufficient security controls. Developers often prioritize functionality over robustness, leading to direct string concatenation or variable substitution without escaping special characters that could alter command execution flow.
To mitigate this risk, users must immediately upgrade the firmware on their Cudy TR3000 routers to version 2.5.42 or later, where the vendor has addressed the input validation issues in the autoreboot script. Until an update is applied, administrators should enforce strong, complex passwords for the web interface and restrict access to trusted IP addresses using network-level controls if possible. Additionally, monitoring system logs for unusual crontab modifications can help detect potential exploitation attempts early. Security teams managing fleets of these devices should prioritize patching as a critical remediation step due to the high severity associated with root-level command injection in internet-facing or perimeter security appliances. Regular audits of embedded device configurations and adherence to secure coding practices that mandate strict input sanitization are essential preventive measures against similar vulnerabilities in IoT infrastructure.