CVE-2026-32833

Name: CVE-2026-32833 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-32833

HIGH

CVSS v3.1: 8.8

NetworkNo user interactionOS Command InjectionVendor advisory ref

Source data as of: 2026-06-27 05:07:21 UTC

At a glance

Severity: HIGH
CVSS: 8.8 v3.1 · NVD
EPSS: EPSS not provided by FIRST.org for this CVE
CISA KEV: No
Type: OS Command Injection · NVD CWE
Attack conditions (CVSS vector): NetworkNo user interaction · Source: NVD Vector
Published: 2026-06-26 · Modified: 2026-06-26
References: Jump to references (2)

CVSS / EPSS / KEV

CVSS v3.1 8.8 / 10 HIGH Source: NVD

CVSS v4.0 8.7 / 10 HIGH Source: NVD

EPSS — EPSS not provided by FIRST.org for this CVE Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system.

Record details

CVE ID: CVE-2026-32833
CVSS (v3.1): 8.8 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8
Impact subscore: 5.9
CISA KEV: No
Weakness (CWE): CWE-78
Affected configurations (CPE): 0
Published: 2026-06-26
Modified: 2026-06-26
Status: Deferred

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Reference https://www.cudy.com/en-us/pages/download-center/lt300-3-0
Vendor advisory https://www.vulncheck.com/advisories/cudy-lt300-os-command-injection-via-ntp-configuration

← Back to all records

CVE-2026-32833

At a glance

CVSS / EPSS / KEV

Description

Record details

References

Related records

Same weakness type (CWE)

Published the same year