CVE-2026-32833: Cudy LT300 3.0 OS command injection
CVE-2026-32833 is verified against Cudy LT300 V3 firmware · firmware affected versions: All firmware versions prior to 2.5.12 (confirmed vulnerable: 2.4.1, 2.4.5) fixed version: 2.5.12 (released 20-May-2026) vulnerability class: Command Injection This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00258.
pruva-verify REPRO-2026-00258 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00258/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Cudy LT300 3.0 running firmware prior to 2.5.12 contains an OS command injection vulnerability. Reproduce: access the router's administrative interface or an exposed service running firmware <2.5.12, identify a parameter passed to a shell, and inject OS commands.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.