CVE-2026-129102: Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange

Q: Who can exploit this vulnerability?

An attacker must already have authenticated administrator access to the Cudy TR3000 management interface. Exploitation also requires the attacker to establish an attacker-controlled IPsec peer connection so that StrongSwan brings up the CHILD_SA.

Q: What privileges does successful exploitation provide?

Successful exploitation allows the authenticated administrator to execute commands as root. The injected configuration causes StrongSwan's updown plugin to run the attacker-supplied directive when the CHILD_SA is established.

Q: Which configurations are affected?

The affected condition is use of the vpn.set_conf RPC method with an IPsec keyexchange value that accepts injected newline characters. The provided information does not state whether IPsec is enabled or configured by default.

Q: What version should be used to remediate the issue?

Upgrade Cudy TR3000 devices to version 2.5.42 or later. Versions before 2.5.42 are affected according to the available information.

Published Nov 13, 2026

Updated

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.setconf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILDSA.

Affected Software

1 affected component

Cudy TR3000<2.5.42

Event History

Nov 13, 2026

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already have authenticated administrator access to the Cudy TR3000 management interface. Exploitation also requires the attacker to establish an attacker-controlled IPsec peer connection so that StrongSwan brings up the CHILD_SA.

What privileges does successful exploitation provide?

Successful exploitation allows the authenticated administrator to execute commands as root. The injected configuration causes StrongSwan's updown plugin to run the attacker-supplied directive when the CHILD_SA is established.

Which configurations are affected?

The affected condition is use of the vpn.set_conf RPC method with an IPsec keyexchange value that accepts injected newline characters. The provided information does not state whether IPsec is enabled or configured by default.

What version should be used to remediate the issue?

Upgrade Cudy TR3000 devices to version 2.5.42 or later. Versions before 2.5.42 are affected according to the available information.

CVE-2026-129102: Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What privileges does successful exploitation provide?

Which configurations are affected?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What privileges does successful exploitation provide?

Which configurations are affected?

What version should be used to remediate the issue?