CVE-2026-75487 in TR3000
Summary
by MITRE • 11/13/2026
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The Cudy TR3000 router firmware prior to version 2.5.42 contains a critical server-side request forgery and remote code execution vulnerability rooted in improper input validation within the WireGuard configuration management interface. This flaw specifically affects authenticated administrators, allowing them to escalate privileges or execute arbitrary commands with root-level permissions on the underlying device operating system. The vulnerability arises from the handling of the private_key parameter during the export operation for WireGuard server configurations. When an administrator initiates a configuration export action through the web-based administrative panel, the backend function action_wireguards_export() processes the provided data without adequately sanitizing special shell characters or validating the structure of the input string before passing it to system execution functions.
The technical mechanism of exploitation relies on the use of command substitution syntax within Linux shells. By submitting a private_key value that includes specific metacharacters such as dollar signs followed by parentheses, an attacker can inject arbitrary commands into the shell environment invoked by luci.sys.exec. This function is designed to execute system-level commands based on user-provided parameters for administrative tasks like exporting configuration files. Because the input string containing the malicious payload is passed directly to this execution engine without proper escaping or filtering of dangerous characters, the operating system interprets the injected syntax as executable code rather than literal data. Consequently, any command embedded within the private_key field during the export process will be executed with the privileges of the web server daemon, which typically runs with root access on many embedded Linux devices to facilitate full administrative control over network interfaces and routing tables.
From an operational impact perspective, this vulnerability grants a significant attack surface for compromise even when authentication is required. While the requirement for valid administrator credentials might seem like a mitigating factor, it does not eliminate the risk in scenarios where session hijacking occurs, credentials are leaked through phishing or brute-force attacks, or if multiple users share administrative access with varying levels of trust and security hygiene. Once exploited, an attacker can achieve complete control over the router's operating system. This level of access allows for the installation of persistent backdoors, modification of firewall rules to bypass network segmentation, interception of unencrypted traffic traversing the device, and potentially pivoting into internal networks connected behind the router. The ability to execute commands as root effectively neutralizes most security controls implemented at the application layer within the web interface itself.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK techniques related to Execution, specifically command and scripting interpreter abuse where attackers leverage legitimate system utilities to execute malicious payloads. The specific context involves the misuse of configuration management functions that interact directly with the operating system shell. To mitigate this risk, users must immediately upgrade their Cudy TR3000 firmware to version 2.5.42 or later, which addresses the input validation flaws in the WireGuard export functionality. Until an update is applied, network administrators should restrict access to the administrative interface using strict firewall rules and monitor for unusual outbound connections or process executions originating from the web server daemon that do not correspond to standard configuration changes.