Cudy Routers CVE-2026-38709

The specific prerequisite is the ability to send crafted input to the net.set_wan WAN-configuration interface on an affected Cudy model at the listed firmware version, which then executes it as root. The CVSS vector (PR:N/UI:N) asserts no authentication and no user interaction are required, but net.set_wan is a device configuration endpoint that is commonly reachable only after authenticating to the router web UI and often only from the LAN - this is a limiting factor that authentication requirements are not conclusively confirmed from available data and should be validated against the vendor advisory. Realistic exploitation therefore depends on whether the management interface is exposed to the WAN and whether the endpoint is accessible pre-authentication; if remote administration is disabled (the default on many consumer routers), an attacker must first gain LAN access.

Signals are partially conflicting and should be weighed carefully. The CVSS 3.1 vector claims network attack vector, low complexity, and no privileges (AV:N/AC:L/PR:N/UI:N) yielding 9.8, which would make this trivially exploitable and high priority. However, net.set_wan is a device configuration interface that on most routers sits behind the authenticated web/management UI, so PR:N may overstate real exposure - verify with the vendor whether net.set_wan is reachable pre-authentication or only from the LAN/management plane. No EPSS score, no CISA KEV entry, and no POC were provided, so there is no evidence of active or automated exploitation; SSVC-style factors (exploitation state, automatability) cannot be populated from the input. Net assessment: technically a critical root-code-execution flaw worth prompt patching, but the practical blast radius depends heavily on whether the interface is exposed to the WAN and whether authentication is required - both currently unconfirmed.

An attacker who can reach the router's management interface submits a crafted value to a WAN configuration parameter handled by net.set_wan, embedding shell metacharacters that break out of the intended command and execute attacker-supplied commands as root. Given AV:N/AC:L, the request requires no user interaction and low complexity, letting the attacker install persistent implants, pivot into the internal network, or hijack DNS/traffic. No public POC was identified, so this scenario is inferred from the CVSS vector and CWE-77 root cause.