What is the CVSS score of CVE-2026-38709?

CVE-2026-38709 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Cudy Routers are affected by CVE-2026-38709?

A critical unauthenticated root command injection vulnerability (CVE-2026-38709) affects multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500), enabling…

How to fix or mitigate CVE-2026-38709?

Within 24 hours: Immediately identify and catalog all deployed Cudy routers across affected models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) and restrict WAN configuration access through firewall rules and network segmentation. Within 7 days: Apply network segmentation to isolate WAN interfaces from untrusted networks, disable remote management features where operationally feasible, implement network-based intrusion detection signatures targeting command injection patterns against net.set_wan parameters, and enable comprehensive command execution logging per vendor advisory cudy-sa-26-7-jezzy-4. Within 30 days: Prepare and execute a phased replacement or upgrade plan for affected routers prioritizing internet-facing instances; establish rapid testing and deployment procedures for when Cudy releases patched firmware; coordinate with vendor for patch availability and timelines.

Cudy Routers CVE-2026-38709

EUVD-2026-51326 CRITICAL

Command Injection (CWE-77)

2026-07-30 mitre

GHSA-xqr5-6593-973m

Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Root command execution gives full C/I/A impact; PR:L chosen because net.set_wan is a router configuration interface typically reachable only after authenticating to the management UI, unlike NVD's PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 12:22 vuln.today

CVSS changed

Jul 31, 2026 - 12:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Root-level command injection in the net.set_wan interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) allows attackers to execute arbitrary OS commands as root by supplying crafted input to WAN configuration parameters. The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying full network-reachable compromise with no privileges required. No public exploit code and no CISA KEV listing were identified at time of analysis, so there is no public exploit identified at this time; the vendor has published security advisory cudy-sa-26-7-jezzy-4.

Technical ContextAI

The affected products are Cudy home/SMB networking devices (routers and travel routers) running Cudy's OpenWrt-derived firmware. The vulnerable element is the net.set_wan interface, an internal RPC/configuration handler used to apply WAN (upstream internet) connection settings. The root-cause class is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning user-controlled WAN configuration values are passed into a shell or system() call without adequate sanitization, allowing shell metacharacters to break out and run attacker-chosen commands. Because embedded router management daemons typically run as root, injected commands inherit root privileges. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder with no meaningful vendor/product data, so exact affected products must be taken from the description's model/firmware list rather than the CPE.

RemediationAI

Apply the fixed firmware for each affected model as published in Cudy security advisory cudy-sa-26-7-jezzy-4 (https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-jezzy-4); a patch is available per the vendor advisory, but no exact fixed version numbers were provided in the input, so consult the advisory for the specific patched build per model before upgrading. Until firmware is updated, reduce exposure by disabling remote/WAN-side administration so the management interface (and net.set_wan) is not reachable from the internet - the trade-off is loss of remote management convenience. Additionally restrict management access to trusted LAN hosts or a management VLAN and change default administrative credentials, which limits an attacker's ability to reach the WAN-configuration interface; the side effect is added operational friction for legitimate remote admins. Do not expose the device web UI to untrusted networks pending patching.