CVE-2026-129103
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by
CVSS
7.2
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 13, 2026 · Last modified: Nov 13, 2026 · CWE-93
Not enough EPSS history yet.
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
- d1jvyy13vm72kv.cloudfront.nethttps://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip
- www.cudy.comhttps://www.cudy.com/en-us/pages/download-center/tr3000-1-0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-scheduled-reboot-time
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1281225.9 MED—
———SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare _redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.4hCVE-2026-1291056.5 MED—
———Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.10hCVE-2026-1291046.5 MED—
———Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.10hCVE-2026-1291027.2 HIG—
———Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.10hCVE-2026-127036——
——0Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS.
This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.1dCVE-2026-863436.8 MED45.2%
——14An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.1d