PT-2026-26968 · Cudy · Cudy Tr1200

B55T4Ck + 1 · Published 2026-03-22 · Updated 2026-03-22 · CVE-2026-4537

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cudy TR1200 version R46-2.4.15-20250721-164017

Description A command injection issue exists in the action ipsec conn function within the /usr/bin/lib/lua/luci/controller/ipsec.lua file. Exploitation of this issue may allow for remote command execution. The vulnerability has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the action ipsec conn function until a patch is available.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-4537

Affected Products

Cudy Tr1200

References · 13

• 🔥 https://github.com/qazmn/my_cve/blob/main/cudy_cve/Cudy_TR1200_Command_Injection.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4537 · Security Note
• https://vuldb.com/?ctiid.352325 · Note
• https://twitter.com/CVEnew/status/2035619706288357667 · Twitter Post
• https://vuldb.com/?submit.774447 · Note
• https://twitter.com/cyberbivash/status/2035591201508794677 · Twitter Post
• https://vuldb.com/submit/774447 · Note
• https://twitter.com/VulmonFeeds/status/2035591785406247203 · Twitter Post
• https://twitter.com/cyberbivash/status/2035588210676412914 · Twitter Post
• https://vuldb.com/vuln/352325 · Note
• https://vuldb.com/vuln/352325/cti · Note
• https://twitter.com/CVEarity/status/2035715887567868097 · Twitter Post
• https://vuldb.com/?id.352325 · Note