PT-2026-52898 · Undefined · Undefined

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-32833

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-32833

Produtos afetados

Undefined

Referências · 3

• https://cudy.com/en-us/pages/download-center/lt300-3-0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32833 · Nota de Segurança
• https://vulncheck.com/advisories/cudy-lt300-os-command-injection-via-ntp-configuration · Nota