EUVD-2026-51647
GHSA-pw34-h6wh-m8r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request to setclock yields root command execution, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as the OS is the vulnerable component.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
AnalysisAI
Command injection in Cudy's OpenWRT-based router firmware allows remote attackers to execute arbitrary commands as root through the system.setclock interface, affecting multiple TR- and WR-series models (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, WR6500 v2.3.15). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with total system compromise, and CISA's SSVC framework rates it Automatable with Total technical impact. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is modest at 1.21% (65th percentile).
Technical ContextAI
The affected devices are Cudy consumer/SOHO networking products (travel routers and Wi-Fi routers) that run a Linux/OpenWRT-derived firmware exposing a web/management backend. The flaw is a CWE-77 Command Injection in the system.setclock handler - a routine intended to set the device clock - where user-supplied input (likely a time/date or NTP parameter) is passed unsanitized into a shell command executed by the underlying OS. Because the management daemon runs with root privileges, injected shell metacharacters lead directly to arbitrary command execution as root. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder/'n/a' and does not enumerate the specific products, so version scoping must be taken from the CVE description and vendor advisory rather than NVD's CPE data.
RemediationAI
Apply the fixed firmware for each affected model as published in Cudy security advisory cudy-sa-26-7-aihgtk (https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-aihgtk); the input data does not enumerate exact patched build numbers, so no vendor-released fix version can be independently confirmed here - consult the advisory for the corrected firmware per model and flash the latest available. As compensating controls until patched: disable remote/WAN management so the setclock interface is not reachable from the internet (trade-off: administrators lose off-LAN management); restrict access to the router management UI to trusted management VLANs or specific admin IPs via firewall/ACL (trade-off: requires network segmentation); and disable any automatic NTP/clock-sync feature that feeds the setclock handler if operationally acceptable (trade-off: device time may drift, affecting logging and TLS validation). Do not expose the device web interface to untrusted networks.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today