CVE-2026-4537

Cudy TR1200 ipsec.lua action_ipsec_conn command injection

View on CVE.org
Published Mar 22, 2026 CVSS 4.0 · 5.1 Medium EPSS 9.8% KEV · Not listed
Description
A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is advised. The vendor explains, that "some other customer has reported this to us before. And we have fixed this."

Analysis

AI-generated

Technical impact

An injection flaw in the action_ipsec_conn function of Cudy TR1200 routers' Lua IPsec controller allows attackers to send crafted requests that cause the device to execute arbitrary shell commands with the router’s internal process privileges; since the function is reachable through normal remote management traffic, the vulnerability enables remote command execution and publicly disclosed exploits confirm practical attack potential, arising from unsanitized user input leading to command injection (CWE-74 and CWE-77).

Affected Systems

Only Cudy TR1200 routers running firmware R46-2.4.15-20250721-164017 are affected; no other firmware versions or products have been reported as impacted.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, yet remote command execution on a network‑connected device elevates practical risk. With an EPSS probability of 10% exploitation is not common at present, and the vulnerability is not listed in CISA KEV, but publicly available exploits and exposure to untrusted networks increase the likelihood of attack.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router firmware to the latest release that addresses the IPsec controller injection.
  • Implement input validation to sanitize all user‑supplied parameters before they are passed to the shell, mitigating CWE-74.
  • Apply command isolation or whitelisting to prevent arbitrary shell execution, following CWE-77 best practices.
  • Restrict or disable remote management access to the IPsec controller until a patch is available.
  • Continuously monitor system logs for abnormal command execution and investigate any suspicious events.

Generated by OpenCVE AI on October 25, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is advised. The vendor explains, that "some other customer has reported this to us before. And we have fixed this."
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Cudy
Cudy tr1200
Vendors & Products Cudy
Cudy tr1200
Type Values Removed Values Added
Description A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Cudy TR1200 ipsec.lua action_ipsec_conn command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 5:52 AM
Reserved
Mar 21, 2026, 8:08 AM

View source JSON

Updated
Mar 23, 2026, 4:21 PM

JSON

Status
Deferred
Published
Mar 22, 2026, 5:16 AM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Oct 25, 2026, 9:45 PM

JSON