Description
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgrade_check interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
Published: 2026-07-31
Score: 9.8 Critical
EPSS: 2.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the system.upgrade_check interface allows injection of arbitrary system commands that run with root privileges. This vulnerability provides attackers with full control over affected devices, enabling data theft, sabotage, or lateral movement in a network. The weakness corresponds to command injection, identified as CWE-77.

Affected Systems

Affected Cudy devices include TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15; all listed versions are susceptible.

Risk and Exploitability

The CVSS score of 9.8 denotes a critical severity. EPSS is 3%, indicating a moderate likelihood of exploitation. The flaw is not listed in CISA KEV, suggesting no known active exploits yet. The likely attack vector is sending crafted input to the system.upgrade_check endpoint over the network; authentication requirements are not specified, implying potential unauthenticated access. An attacker can execute arbitrary commands as root, fully compromising the device.

Generated by OpenCVE AI on August 4, 2026 at 22:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor firmware update that fixes the command injection in system.upgrade_check.
  • Restrict or disable the system.upgrade_check interface by configuring firewall rules or device settings.
  • Place the device in an isolated network segment and control inbound traffic to limit exposure.

Generated by OpenCVE AI on August 4, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Cudy
Cudy tr1200
Cudy tr3000
Cudy wr1200
Cudy wr1300
Cudy wr1500
Cudy wr300
Cudy wr3000
Cudy wr3600
Cudy wr6500
Vendors & Products Cudy
Cudy tr1200
Cudy tr3000
Cudy wr1200
Cudy wr1300
Cudy wr1500
Cudy wr300
Cudy wr3000
Cudy wr3600
Cudy wr6500

Tue, 04 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Command Injection in system.upgrade_check Enables Root Execution

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Command Injection in system.upgrade_check Enables Root Execution
Weaknesses CWE-77

Fri, 31 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgrade_check interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-03T19:25:49.252Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38711

cve-icon Vulnrichment

Updated: 2026-08-03T19:25:44.811Z

cve-icon NVD

Status : Received

Published: 2026-07-31T20:16:50.190

Modified: 2026-08-03T20:17:23.350

Link: CVE-2026-38711

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T11:13:36Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')