Cudy LT300 EUVD-2026-39862

Exploitation requires authenticated access to the LT300 web management interface (CVSS PR:L - a valid low-privileged account, not necessarily full admin) plus network reachability to that interface; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is the ability to submit a crafted POST to the system time configuration endpoint with shell metacharacters in the cbid.system.ntp.current parameter. Limiting factors: the attacker must first obtain working credentials and the management interface must be reachable, so a router whose web UI is confined to the LAN and protected by strong unique passwords is substantially harder to exploit; only LT300 3.0 firmware versions prior to 2.5.12 are affected.

Signals are largely consistent and point to a genuinely high-impact but precondition-gated issue. The CVSS 4.0 base score is 8.7 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, meaning network-reachable, low-complexity exploitation that requires authentication and grants complete system compromise. The PR:L requirement is the primary limiter: the attacker must already hold low-privileged web-UI credentials, so this is not a pre-auth internet-worm scenario by default - though weak/default/reused passwords and WAN-exposed management interfaces materially raise real-world risk. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified, and the absence of a KEV entry means there is no confirmation of active exploitation. No public PoC was referenced. The reporter (VulnCheck) is a credible vulnerability-intelligence source, which raises confidence the finding is real even though weaponization status is unknown.

An attacker who has obtained low-privileged web-UI credentials (for example via a default password, credential reuse, or an exposed management interface) logs into the LT300 console, opens the system time settings, and submits an NTP value such as a hostname followed by ;<command> in the cbid.system.ntp.current POST parameter. The injected command executes on the router OS, granting code execution and likely full device control. No public PoC was referenced, and CVSS AC:L/AT:N indicates the injection is straightforward once authenticated.