CVE-2026-75494
HIGH
NVD
CVSS Score
7.4
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.