The vulnerability exists in Cudy LT300 3.0 firmware versions earlier than 2.5.12, where an authenticated attacker can inject shell metacharacters into the cbid.system.ntp.current POST parameter of the system time configuration interface. This permits the execution of arbitrary OS commands, effectively giving the attacker full control over the device’s operating system. The weakness is a classic OS command injection flaw (CWE‑78), providing attackers the ability to exfiltrate data, modify system settings, or use the device as a launch point for further attacks.

The affected devices are LT300 3.0 units manufactured by Shenzhen Cudy Technology Co., Ltd. All firmware releases before version 2.5.12 are vulnerable; newer firmware has the mitigation applied. No additional vendor or product names are necessary beyond the mentioned model.

The CVSS score of 8.7 classifies this as a high‑severity flaw. The EPSS score is 1%, indicating a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Given that the flaw requires authentication and only affects the NTP configuration interface, exploitation remains plausible in environments where administrators or privileged users have network access to the device or where the web interface is exposed to untrusted networks.