Vulnerability · Published Mar 22, 2026 · Assigned by VulDB

CVE-2026-4537Cudy TR1200 ipsec.lua action_ipsec_conn command injection

Medium 4.7

In plain English

A medium-severity command injection in TR1200 from Cudy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)9.5%top 4.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is advised. The vendor explains, that "some other customer has reported this to us before. And we have fixed this."

Affected products (as reported)

Vendor	Product	Versions
Cudy	TR1200	R46-2.4.15-20250721-164017

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-352325 | Cudy TR1200 ipsec.lua action_ipsec_conn command injection vdb-entry, technical-description
VDB-352325 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #774447 | cudy AC1200 Wi-Fi Mini VPN Router TR1200 1.0 TR1200-R46-2.4.15-20250721-164017-flash.zip Command Injection third-party-advisory
https://github.com/qazmn/my_cve/blob/main/cudy_cve/Cudy_TR1200_Command_Injection.md exploit