What is the CVSS score of CVE-2026-38713?

CVE-2026-38713 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Cudy Routers are affected by CVE-2026-38713?

Cudy TR- and WR-series routers used in production networks contain a critical vulnerability enabling remote root-level command execution, with no available vendor patch to remediate the risk.

How to fix or mitigate CVE-2026-38713?

Within 24 hours, inventory all Cudy TR- and WR-series routers in production and staging environments, identifying devices running affected versions: TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16), or WR6500 (v2.3.15). Within 7 days, immediately isolate affected routers by restricting network access to authorized management subnets, disabling unnecessary remote administration and ipsec services if operationally feasible, and deploying continuous monitoring on ipsec_conn interfaces for command injection attempts. Within 30 days, monitor Cudy's security advisory channels for patch releases, conduct forensic review of affected devices for evidence of prior exploitation, initiate procurement and testing of replacement hardware from vendors with active security support programs, and implement network segmentation improvements to limit blast radius if future vulnerabilities are discovered.

Cudy Routers CVE-2026-38713

EUVD-2026-51648 CRITICAL

Command Injection (CWE-77)

2026-07-31 mitre

GHSA-r4gp-3c4m-74m2

Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable command injection yielding root (C/I/A:H); PR:L rather than PR:N because the ipsec_conn VPN-config interface typically sits behind router admin authentication.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 22:30 vuln.today

CVSS changed

Aug 03, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 31, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 31, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

AnalysisAI

Root-level command injection in Cudy TR- and WR-series routers lets attackers run arbitrary OS commands through the ipsec_conn interface, which fails to sanitize user-supplied input before passing it to a shell context. Affected models span TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16), and WR6500 (v2.3.15). No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is modest at 1.21% (65th percentile), so this is a high-severity design flaw without evidence of widespread exploitation yet.

Technical ContextAI

The vulnerable component is the ipsec_conn interface, part of the routers' IPsec VPN connection handling within the embedded Linux (OpenWrt-style) management stack typical of Cudy SOHO devices. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning attacker-controlled parameters passed to the ipsec_conn routine are concatenated into a system/shell call without escaping or allow-list validation, so shell metacharacters (;, |, `, $()) break out of the intended command. Because router management daemons on these devices generally run as root, injected commands inherit full root privileges. The CPE data supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not enumerate the actual affected products - the authoritative product/version list comes from the CVE description and the Cudy security advisory.

RemediationAI

Apply the fixed firmware released by Cudy for each affected model per the vendor advisory at https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-ehixbe (Patch available per vendor advisory; an exact fixed version was not provided in the input data - confirm the target build on Cudy's advisory before deploying). Until patched firmware is installed, reduce exposure by disabling the IPsec/VPN feature if it is not in use, and ensure the router's web/management and IPsec interfaces are not reachable from the WAN - restrict administration to the LAN or a trusted management VLAN and block external access to the management and IKE/IPsec ports (UDP 500/4500) at the perimeter; the trade-off is loss of remote VPN and remote-admin functionality. Additionally change default administrative credentials and monitor the device for anomalous outbound connections, since successful exploitation yields root. Corroborating references: https://nvd.nist.gov/vuln/detail/CVE-2026-38713 and https://vuldb.com/vuln/385141.