CVE-2026-75488 in TR3000
Summary
by MITRE • 11/13/2026
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Cudy TR3000 firmware versions prior to 2.5.42 represents a critical security flaw within the Common Management Protocol client implementation. This device relies on the TR-069 protocol, also known as CWMP, for remote management and configuration by an Auto Configuration Server or ACS. The specific defect is located in how the software handles authentication credentials during data transfer operations such as Download or Upload requests. When a malicious actor controls the ACS endpoint, they can exploit this flaw to execute arbitrary code or cause a denial of service against the target router. This scenario highlights the risk associated with trusting remote management interfaces that are often exposed to untrusted networks or compromised administrative servers.
The technical root cause is a stack buffer overflow resulting from insufficient bounds checking on input data. The CWMP client allocates fixed-size buffers of one hundred twenty-eight bytes on the call stack to store incoming Username and Password fields. However, the protocol allows these credentials to be transmitted with lengths up to two hundred fifty-six bytes. Because there is no validation mechanism to truncate or reject payloads exceeding the allocated buffer size, writing more than one hundred twenty-eight bytes causes data to spill over into adjacent memory locations on the stack. This corruption can overwrite critical return addresses and saved frame pointers, leading to control flow hijacking if an attacker carefully crafts the overflow payload, or causing a segmentation fault that crashes the CWMP process entirely.
From an operational perspective, this vulnerability has severe implications for network integrity and availability. If exploited successfully through code execution, an attacker could gain full administrative access to the router, allowing them to intercept traffic, modify DNS settings, install persistent malware, or pivot into internal networks protected by the device. Even in its simplest form as a denial of service attack, crashing the CWMP process disrupts remote management capabilities and may destabilize other network services running on the embedded Linux system. This is particularly dangerous because TR-069 connections are often established over the internet without additional authentication layers beyond the protocol credentials themselves, making them attractive targets for automated scanning campaigns.
This flaw aligns with CWE-121, which defines stack-based buffer overflow as a type of memory corruption where data exceeds the bounds of a fixed-length buffer on the call stack. It also relates to CWE-787, an out-of-bounds write that occurs when writing data beyond the allocated boundary. In terms of offensive security frameworks, this vulnerability facilitates MITRE ATT&CK technique T1059 Command and Scripting Interpreter if code execution is achieved, or T1499 Endpoint Denial of Service if only a crash is induced. The attack vector involves sending crafted TR-069 messages to the ACS endpoint, leveraging the trust relationship between the device and its management server.
Mitigation requires immediate firmware updates to version 2.5.42 or later where this issue has been resolved by implementing strict length validation before copying credentials into stack buffers. Administrators should ensure that their TR-069 connections are secured using TLS encryption to prevent eavesdropping on credential transmission, although this does not mitigate the overflow itself if the ACS is compromised. Network segmentation strategies can also limit exposure by restricting access to management ports only from trusted IP ranges within a secure administrative network rather than exposing them directly to the public internet. Regular auditing of connected devices and monitoring for anomalous CWMP traffic patterns provide additional layers of defense against exploitation attempts targeting this class of embedded system vulnerabilities.