Is CVE-2026-38713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38713 being exploited in the wild.

How severe is CVE-2026-38713?

Informational severity, published 31 July 2026.

Which products and versions are affected?

Cudy TR1200 v2.4.15; Cudy TR3000 v2.4.21; Cudy WR1200 v2.4.23; Cudy WR1300 v2.4.22; and 5 more.

Is there a fix for CVE-2026-38713?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38713 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38713?

Check whether you run Cudy TR1200, Cudy TR3000, Cudy WR1200 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38713: Cudy Routers command injection in ipsec_conn interface

CVE-2026-38713 · Severity: info · Published 2026-07-31

A security vulnerability has been identified in several Cudy router models, which are devices used to provide internet connectivity and secure networking for homes and small offices. An attacker can exploit this flaw to take full control of the router by executing unauthorized commands with the highest level of administrative privileges. This could lead to the interception of network traffic, theft of sensitive data, or a complete shutdown of internet services.

Technologies: Cudy TR1200, Cudy TR3000, Cudy WR1200, Cudy WR1300, Cudy WR1500, Cudy WR300, Cudy WR3000, Cudy WR3600, Cudy WR6500. Vendors: Cudy.

Quick answers

Is CVE-2026-38713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38713 being exploited in the wild.
How severe is CVE-2026-38713?: Informational severity, published 31 July 2026.
Which products and versions are affected?: Cudy TR1200 v2.4.15; Cudy TR3000 v2.4.21; Cudy WR1200 v2.4.23; Cudy WR1300 v2.4.22; and 5 more.
Is there a fix for CVE-2026-38713?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38713 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38713?: Check whether you run Cudy TR1200, Cudy TR3000, Cudy WR1200 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the 'ipsec_conn' interface of multiple Cudy router models. The flaw stems from insufficient sanitization of user-supplied input passed to system-level commands within the IPsec configuration component. An attacker can exploit this by sending specially crafted input to the affected interface, leading to arbitrary command execution with root privileges. The vulnerability affects various firmware versions across the TR and WR product lines, including TR1200 v2.4.15 and WR3000 v2.4.19. Users are advised to check the manufacturer's security advisory for firmware updates.

Affected products

Cudy TR1200 v2.4.15
Cudy TR3000 v2.4.21
Cudy WR300 v2.4.25
Cudy WR1200 v2.4.23
Cudy WR1300 v2.4.22
Cudy WR1500 v2.3.10
Cudy WR3000 v2.4.19
Cudy WR3600 v2.3.16
Cudy WR6500 v2.3.15

Timeline

2026-07-31: disclosed: CVE published to NVD

References

https://www.cudy.com/pages/security-advisory/cudy-sa-26-7-ehixbe

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.