Vulnerability · Published Jun 26, 2026 · Assigned by VulnCheck

CVE-2026-32833Cudy LT300 3.0 OS Command Injection via NTP Configuration

High 8.8

In plain English

A high-severity OS command injection in LT300 3.0 from Shenzhen Cudy Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.4%top 15.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.

Affected products (as reported)

Vendor	Product	Versions
Shenzhen Cudy Technology Co., Ltd.	LT300 3.0	0 – before 2.5.12

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.cudy.com/en-us/pages/download-center/lt300-3-0 release-notes, patch
https://www.vulncheck.com/advisories/cudy-lt300-os-command-injection-via-ntp-configuration third-party-advisory