Vendor
Shenzhen Cudy Technology
23 known vulnerabilities.
Shenzhen Cudy Technology at a glance
- Last 12 months
- 23
- Critical · all time
- 4
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 20 | 3 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 2 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
23 results · Feed
-
High 7.2
Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the in…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to ex…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authe…
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, …
-
High 7.0
Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject…
-
High 7.0
Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administra…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
High 8.2
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS…
-
High 7.5
Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycm…
-
Medium 6.8
Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent u…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so th…
-
Medium 5.9
Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicio…
-
High 8.7
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP…
-
High 7.4
Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add opt…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call…
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.ex…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
High 8.8
Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The s…
-
Critical 9.1
Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the f…
-
High 8.8
Cudy LT300 3.0 OS Command Injection via NTP Configuration
Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the s…