CVE-2026-32833CWE-78

Cudy LT300 3.0 OS Command Injection via NTP Configuration

High · published June 26, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02424 · 84.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-26T19:54Z
EPSS history
Timeline
  • 26 JUN 19:54Z
    Cudy LT300 3.0 OS Command Injection via NTP Configuration
    cvelistv5