Description
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Cudy Technology | TR3000 1.0 | < 2.5.42 | 2.5.42 |
References
- Cudy TR3000 1.0 Download Center release-notes
- Cudy TR3000 Firmware 2.5.42 patch
- VulnCheck Advisory: Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption third-party-advisory