CVE-2026-129100: Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection

Q: Who can exploit this vulnerability?

An attacker needs authenticated administrator access to the Cudy TR3000 management interface and the ability to upload OpenVPN private or tls-auth key material. The issue is remotely exploitable over the network once those privileges are available.

Q: What level of access can successful exploitation provide?

Successful exploitation causes OpenVPN to execute an injected hook as root. This can give the attacker full confidentiality, integrity, and availability impact on the affected device.

Q: Which versions are affected and what is the remediation?

Cudy TR3000 versions before 2.5.42 are affected. Upgrade to version 2.5.42 or later.

Q: What can be done if an upgrade cannot be applied immediately?

Restrict administrator-interface access to trusted administrators and prevent untrusted parties from uploading or modifying OpenVPN private or tls-auth keys. Review existing OpenVPN key uploads and configuration for injected directives or unexpected hook settings.

Published Nov 13, 2026

Updated

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root.

Affected Software

1 affected component

Cudy TR3000<2.5.42

Event History

Nov 13, 2026

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs authenticated administrator access to the Cudy TR3000 management interface and the ability to upload OpenVPN private or tls-auth key material. The issue is remotely exploitable over the network once those privileges are available.

What level of access can successful exploitation provide?

Successful exploitation causes OpenVPN to execute an injected hook as root. This can give the attacker full confidentiality, integrity, and availability impact on the affected device.

Which versions are affected and what is the remediation?

Cudy TR3000 versions before 2.5.42 are affected. Upgrade to version 2.5.42 or later.

What can be done if an upgrade cannot be applied immediately?

Restrict administrator-interface access to trusted administrators and prevent untrusted parties from uploading or modifying OpenVPN private or tls-auth keys. Review existing OpenVPN key uploads and configuration for injected directives or unexpected hook settings.

CVE-2026-129100: Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access can successful exploitation provide?

Which versions are affected and what is the remediation?

What can be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of access can successful exploitation provide?

Which versions are affected and what is the remediation?

What can be done if an upgrade cannot be applied immediately?