EUVD-2026-39862
GHSA-wcjj-vwjf-qqvc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web endpoint with low-complexity injection but requiring a valid low-privileged account (PR:L), yielding root-level command execution and full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.
AnalysisAI
Remote code execution in the Cudy LT300 3.0 4G LTE router (firmware before 2.5.12) lets authenticated users run arbitrary OS commands by embedding shell metacharacters in the cbid.system.ntp.current POST parameter of the system time (NTP) configuration page. Because the CVSS 4.0 vector specifies PR:L, an attacker needs valid (low-privileged) web credentials but no user interaction, and successful injection yields full host compromise (VC/VI/VA all High). No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.
Technical ContextAI
The Cudy LT300 is an OpenWrt/LuCI-based 4G LTE SOHO router; the affected endpoint (cbid.system.ntp.current) is a LuCI UCI form field bound to the system NTP/time configuration. The root cause is CWE-78 (OS Command Injection): user-supplied NTP input is passed into a shell context - typically a system()-style or backtick invocation used to set or sync time - without neutralizing shell metacharacters such as ;, |, &, $() and backticks. The single affected build is identified by CPE cpe:2.3:a:shenzhen_cudy_technology_co.,_ltd.:lt300_3.0, i.e. the LT300 3.0 firmware line prior to 2.5.12. On these devices the web backend generally runs as root, so injected commands inherit root privileges.
RemediationAI
Vendor-released patch: firmware version 2.5.12 - upgrade all Cudy LT300 3.0 units to 2.5.12 or later via the official download center at https://www.cudy.com/en-us/pages/download-center/lt300-3-0, and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/cudy-lt300-os-command-injection-via-ntp-configuration. Until patching is complete, reduce exposure by ensuring the web management interface is not reachable from the WAN/internet and is restricted to trusted management hosts or a management VLAN (side effect: remote administration from outside the LAN is no longer possible), and by rotating any default or weak admin/operator credentials and enforcing strong unique passwords, since exploitation depends on holding a valid low-privileged account. Avoid shared low-privilege web accounts and monitor the system-time/NTP configuration for values containing shell metacharacters.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today