Threats tagged 'ghsa-7mmp-hvpj-x928'

Cudy TR3000 devices running firmware versions before 2.5.42 have an argument injection vulnerability in the easycwmpd Upload handler. This flaw allows a malicious or compromised Auto Configuration Server (ACS) to inject arbitrary curl command options via unfiltered Username and Password fields. Exploitation can enable attackers to write attacker-controlled HTTP responses to arbitrary files on the device, potentially impacting integrity and availability.