A command injection flaw exists in the net.set_wan interface of certain Cudy routers, allowing an attacker to inject arbitrary commands that execute with root privileges. The weakness is a classic CWE‑77 scenario where unsanitised input is passed directly to a shell. If exploited, the attacker gains full control of the device, compromising confidentiality, integrity, and availability of the network the router serves.

Cudy routers – TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16) and WR6500 (v2.3.15) – are all affected. These devices expose the vulnerable net.set_wan interface over the network and have not been patched to this version.

The CVSS score of 9.8 reflects the high severity of this vulnerability; the EPSS score of 3% indicates a moderate likelihood of exploitation, but the lack of a KEV listing does not diminish the impact. The attack vector is inferred to be remote, as the net.set_wan interface is accessible over the network, although it may require enumeration of device services and potentially valid credentials. Because the flaw permits execution as root, the full attack surface is all system functionalities, making this a critical risk for any network that relies on the listed router models.