CVE-2026-38710

HighCVSS 7.2

Published: 31/07/2026(UTC)Updated: 03/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.21%

65th percentile - higher than 65% of all known CVEs

Summary

Routers TR1200 and TR3000 with firmware versions v2.4.15 and v2.4.21 contain a command injection vulnerability in the system.setclock interface. Attackers can execute arbitrary commands as root via crafted input.

Risk Assessment

Attackers can gain full control over the device, leading to network compromise and data theft.

Recommendation

Update the router firmware to the latest available version that fixes this vulnerability.

Other vulnerabilities in TR1200

See all

CVE-2026-38713Critical
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the ipsec_conn interface. Attackers can execute arbitrary commands as root via crafted input.
CVE-2026-38708Critical
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.setclock interface. Attackers can execute arbitrary commands as root via crafted input.
CVE-2026-38711Critical
Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.upgrade_check interface. Attackers can execute arbitrary commands as root via crafted input.

Original NVD description (English source)

TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.