Description
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Cudy Technology | TR3000 1.0 | < 2.5.42 | 2.5.42 |
References
- Cudy TR3000 1.0 Download Center release-notes
- Cudy TR3000 Firmware 2.5.42 patch
- VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time third-party-advisory