CVE-2026-129099: Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cudy TR3000to a version that resolves this vulnerability.Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs authenticated administrator access to the Cudy TR3000 management interface and must be able to import a malicious OpenVPN client configuration. Exploitation also requires the router to connect to an attacker-controlled VPN endpoint.
Which configurations are affected?
The issue affects Cudy TR3000 devices running versions before 2.5.42 where an administrator can import OpenVPN client configurations. Malicious tls-verify or ipchange directives can bypass the incomplete denylist.
What is the impact of successful exploitation?
Successful exploitation allows commands supplied through the malicious VPN configuration to run as root on the router. This can compromise the router's confidentiality, integrity, and availability.
What should be done if an immediate update is not possible?
Do not import OpenVPN client configurations from untrusted sources, and avoid connecting imported configurations to attacker-controlled VPN endpoints. Restrict administrator access to trusted users because administrator authentication is required for exploitation.