Threats tagged 'ghsa-f5w6-59gc-6cwg'

Cudy TR3000 devices running firmware versions before 2.5.42 have an OS command injection vulnerability. This flaw allows a malicious or compromised Auto Configuration Server (ACS) to execute arbitrary commands as root by sending a specially crafted SetParameterValues request. The vulnerability arises because user-supplied input is concatenated unsafely into a command executed by the system, leading to root-level command execution.