Which versions of Tr1200 are affected by CVE-2026-4537?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4537, a command injection vulnerability rated CVSS 4.7.

Is there a public PoC exploit available for CVE-2026-4537?

Yes, a public proof-of-concept exploit is available for CVE-2026-4537. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-4537?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Tr1200 CVE-2026-4537

Q: What is the CVSS score of CVE-2026-4537?

CVE-2026-4537 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-14277 LOW

Command Injection (CWE-77)

2026-03-22 VulDB

GHSA-cgfg-qq46-f464

Command Injection Tr1200 Cudy

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 04:30 euvd

EUVD-2026-14277

Analysis Generated

Mar 22, 2026 - 04:30 vuln.today

CVE Published

Mar 22, 2026 - 04:02 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the IPSec controller of Cudy TR1200 routers (R46-2.4.15-20250721-164017) allows remote attackers with administrative privileges to execute arbitrary commands through the action_ipsec_conn function. Public exploit code is available for this vulnerability, and the vendor has not released a patch despite early notification. The attack requires high-level access but involves minimal complexity and affects confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability resides in the Lua-based web interface controller located at /usr/bin/lib/lua/luci/controller/ipsec.lua, which is part of LuCI (Lua Configuration Interface), a common embedded web management framework for OpenWrt-based routers. The action_ipsec_conn function fails to properly sanitize user-supplied input before passing it to system commands, allowing command injection attacks. This is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), a direct consequence of inadequate input validation in contexts where user data flows into OS command execution. The Cudy TR1200 is a residential WiFi router running a custom OpenWrt-based firmware, making it a typical target for embedded device attacks. The affected CPE is cpe:2.3:a:cudy:tr1200:*:*:*:*:*:*:*:*, indicating all versions of the TR1200 application may be vulnerable.

RemediationAI

Immediate patch availability is unavailable due to vendor non-response. Users should immediately restrict network access to the Cudy TR1200's web management interface (default port 8080 or 80) to trusted administrative networks only, using firewall rules or network segmentation. If remote administration is required, implement a VPN tunnel or SSH bastion host to control access to the device. As a temporary mitigation, disable IPSec functionality if not actively used, or monitor firewall logs for suspicious IPSec configuration requests. Given the public exploit availability, consider isolating affected devices from untrusted networks until the vendor releases a patch or the device is replaced. Monitor the public GitHub disclosure (https://github.com/qazmn/my_cve/blob/main/cudy_cve/Cudy_TR1200_Command_Injection.md) and VulDB entry (https://vuldb.com/?id.352325) for vendor updates, though none are currently expected given the vendor's non-response to early disclosure.