NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-75494 — TR3000 1.0

HIGH

CVE-2026-75494 is a high-severity (CVSS 7.4) Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Shenzhen Cudy Technology Co., Ltd. TR3000 1.0. A fix is available — see the affected versions and patch details below.

Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 13, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs47th percentile — riskier than 47% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Description

Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.

Affected Products

1 product · 1 configurations
Application
TR3000 1.0Shenzhen Cudy Technology Co., Ltd.
< 2.5.42
1 version
0

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every Shenzhen Cudy Technology Co., Ltd. TR3000 1.0 deployment and check each version against the affected-products list above.

  2. Fix

    Apply the Shenzhen Cudy Technology Co., Ltd. TR3000 1.0 security patch or hotfix for CVE-2026-75494 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.
O3 Security · Runtime Protection

Is CVE-2026-75494 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works