{"id":"CVE-2026-75494","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-75494","summary":"Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values…","details":"Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.","published":"2026-11-13T09:36:54.477Z","modified":"2026-11-13T20:36:20.984Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"},{"type":"FIX","url":"https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-curl-argument-injection-via-tr-069-upload"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-13T20:36:20.984Z"}}