What is the CVSS score of CVE-2026-38710?

CVE-2026-38710 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Cudy TR Router are affected by CVE-2026-38710?

Cudy TR1200 and TR3000 routers (firmware v2.4.15 and v2.4.21) contain an authenticated command injection vulnerability enabling administrators to execute arbitrary root-level commands, resulting in…

How to fix or mitigate CVE-2026-38710?

Within 24 hours, inventory all Cudy TR1200 (v2.4.15) and TR3000 (v2.4.21) routers across your network and document current administrative access. Within 7 days, implement network segmentation to isolate router management interfaces, enforce multi-factor authentication on all administrative accounts, and disable remote administration if operationally feasible. Within 30 days, evaluate long-term remediation including router replacement or firmware upgrades once available, establish quarterly access reviews for all administrator accounts, and configure centralized logging of all administrative commands executed on affected devices.

Cudy TR Router CVE-2026-38710

EUVD-2026-51646 HIGH

Command Injection (CWE-77)

2026-07-31 mitre

GHSA-hwxp-8fwh-7vcp

Command Injection N A

7.2

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-accessible admin interface requires high-privilege credentials (PR:H); no interaction needed; root-level command execution yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 15:23 vuln.today

CVSS changed

Aug 03, 2026 - 15:22 NVD

7.2 (HIGH)

CVE Published

Jul 31, 2026 - 00:00 cve.org

HIGH 7.2

CVE Published

Jul 31, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Command injection in Cudy TR1200 (firmware v2.4.15) and TR3000 (firmware v2.4.21) routers via the system.setclock interface enables an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability stems from unsanitized input passed directly to a system command, yielding full device compromise - confidentiality, integrity, and availability all rated high. No public exploit or active exploitation (CISA KEV) has been identified; EPSS of 1.21% at the 65th percentile reflects moderate relative risk among disclosed CVEs but low absolute exploitation probability.

Technical ContextAI

The affected devices are Cudy-branded consumer and SMB routers (TR1200 and TR3000 model lines). The vulnerable interface, system.setclock, is a firmware-level API endpoint responsible for time synchronization configuration. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning that attacker-controlled input is concatenated into a shell command without adequate sanitization or escaping. This class of flaw allows shell metacharacters - such as semicolons, backticks, or pipe operators - to break out of the intended command context and inject arbitrary OS instructions. Because the system.setclock function executes in a privileged context, successful injection results in commands running as root. NVD CPE data is listed as n/a, limiting machine-readable product tracking, but the vendor advisory at cudy.com confirms the affected product lines.

RemediationAI

Consult the Cudy security advisory at https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-vufm-1-e for patched firmware and upgrade the TR1200 and TR3000 devices to the vendor-recommended fixed version - no exact patched firmware version number is confirmed from available input data, so the advisory is the authoritative source. As an immediate compensating control, disable WAN-side (remote) management access on the router if it is not operationally required, since exploitation is network-accessible and eliminating internet exposure of the admin interface eliminates the external attack surface. Additionally, restrict management interface access to specific trusted IP addresses via firewall or access control lists, and enforce strong, unique administrative credentials to raise the bar for credential-based exploitation. Note that IP restriction without patching does not eliminate insider or lateral-movement risk.