CVE-2026-32833
Cudy LT300 3.0 OS Command Injection via NTP Configuration
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.
| CWE | CWE-78 |
| Vendor | shenzhen cudy technology co., ltd. |
| Product | lt300 3.0 |
| Published | Jun 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for shenzhen cudy technology co., ltd. lt300 3.0
Be the first to know when new high vulnerabilities affecting shenzhen cudy technology co., ltd. lt300 3.0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Shenzhen Cudy Technology Co., Ltd. / LT300 3.0
0 < 2.5.12
References
Credits
Dan Owen VulnCheck