What is the CVSS score of CVE-2026-38711?

CVE-2026-38711 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Cudy Routers are affected by CVE-2026-38711?

Nine Cudy router models in production environments are vulnerable to unauthenticated remote compromise, exposing network infrastructure and connected business systems to infiltration, data theft, and…

How to fix or mitigate CVE-2026-38711?

Within 24 hours, conduct a complete inventory of Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) across all facilities and immediately apply network-level restrictions to limit external access to the upgrade_check interface. Within 7 days, contact Cudy technical support to request firmware hotfixes or workarounds; implement network segmentation to isolate affected devices from critical systems; and deploy detection rules for anomalous administrative traffic or command execution patterns. Within 30 days, initiate procurement of replacement routers from vendors with available security patches; execute a hardware migration plan for affected models; establish and document backup connectivity options in case affected routers must be taken offline; and institute a mandatory patch-readiness assessment for all network appliances.

Cudy Routers CVE-2026-38711

EUVD-2026-51649 CRITICAL

Command Injection (CWE-77)

2026-07-31 cve@mitre.org

GHSA-2784-vww3-7pr6

Command Injection

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable management interface with trivial command injection yielding root gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 22:30 vuln.today

CVSS changed

Aug 03, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 31, 2026 - 20:16 cve.org

CRITICAL 9.8

CVE Published

Jul 31, 2026 - 20:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgrade_check interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Command injection in the system.upgrade_check interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) lets remote attackers run arbitrary commands as root via crafted input. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, and CISA SSVC marks the flaw as automatable with total technical impact. There is no public exploit identified at time of analysis, and the EPSS score is a moderate 1.21% (65th percentile).

Technical ContextAI

The affected products are Cudy consumer/SMB networking devices (Wi-Fi routers and travel routers) running Cudy's OpenWrt-derived firmware, whose web/RPC management layer exposes a 'system.upgrade_check' interface used to query or trigger firmware upgrade checks. CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the root cause: attacker-supplied input reaching this interface is passed into a shell/system call without adequate sanitization or argument separation, so shell metacharacters (e.g. ;, |, `, $()) are interpreted rather than treated as literal data. Because router management daemons typically execute as root, injected commands inherit root privileges. EUVD reports affected versions as 'n/a', so exact firmware boundaries must be taken from the CVE description's per-model version list.

RemediationAI

Consult the Cudy security advisory at https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-7-kjw-1-b for the fixed firmware builds and upgrade each affected model to the vendor-supplied patched version once identified (no exact fixed version numbers are given in the provided data - do not assume; obtain them from the advisory). As compensating controls until patched: disable remote/WAN management so the router web/RPC interface is not internet-reachable (trade-off: administrators lose off-LAN management); restrict access to the management interface to a trusted management VLAN or specific admin IPs via firewall/ACL (trade-off: added configuration and possible lockout risk if rules are wrong); and where a firmware auto-update-check feature can be disabled, doing so reduces exposure of the vulnerable upgrade_check path at the cost of losing automated update notifications. Also change default admin credentials and monitor the device for anomalous processes, though these do not fully block an unauthenticated injection. Patch status: Patch available per vendor advisory (exact fixed version not stated in provided data).