Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-75495. Nothing runs until you send it.
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.