Cudy vulnerabilities

Products

• lt400 3
• lt400 firmware 3
• TR1200 2
• LT500E 1
• lt500e firmware 1
• WR1200EA 1

Latest Cudy CVEs

Newest publication first

1. CVE-2026-4537 Cudy TR1200 ipsec.lua action_ipsec_conn command injection

   Published 2026-03-22

   Medium·CVSS 5.1 EPSS 9.8%

   A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit ha...

2. CVE-2025-11134 Cudy TR1200 Wireless Settings config cross site scripting

   Published 2025-09-29

   Medium·CVSS 4.8 EPSS 0.27%

   A security vulnerability has been detected in Cudy TR1200 1.16.3-20230804-164635. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wireless/config/ of the component Wireless Settings Page. Such manipulation of the argument SSID leads to cross site scripting...

3. CVE-2025-9725 Cudy LT500E Web shadow hard-coded password

   Published 2025-08-31

   Low·CVSS 2.0 EPSS 0.37%

   A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity...

4. CVE-2025-9589 Cudy WR1200EA shadow default password

   Published 2025-08-28

   Low·CVSS 2.0 EPSS 0.13%

   A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead to use of default password. The attack needs to be launched locally. A high complexity level is associated with this att...

5. CVE-2023-31851 Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.

   Published 2023-07-17

   Medium·CVSS 6.1 EPSS 0.50%

   Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.

6. CVE-2023-31853 Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.

   Published 2023-07-17

   Medium·CVSS 6.1 EPSS 0.50%

   Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.

7. CVE-2023-31852 Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.

   Published 2023-07-17

   Medium·CVSS 6.1 EPSS 0.67%

   Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.