CVE-2026-129105: Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials

Q: Who can exploit this issue?

An authenticated administrator who can invoke the net.set_wan RPC method can exploit it. The attacker supplies crafted L2TP usernames or passwords containing quotes and newlines.

Q: What is the impact of successful exploitation?

Injected content is written into a pppd options file and can add arbitrary pppd options to the root pppd process. The stated examples include adding the logfile option, and the vulnerability is rated for integrity and availability impact.

Q: Which systems are affected and what version fixes it?

Cudy TR3000 devices running versions before 2.5.42 are affected. Upgrade to version 2.5.42 or later.

Published Nov 13, 2026

Updated

Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.setwan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.

Affected Software

1 affected component

Cudy TR3000<2.5.42

Event History

Nov 13, 2026

CVE Published

via MITRE·03:38 PM

Data Sourced

via MITRE·03:38 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated administrator who can invoke the net.set_wan RPC method can exploit it. The attacker supplies crafted L2TP usernames or passwords containing quotes and newlines.

What is the impact of successful exploitation?

Injected content is written into a pppd options file and can add arbitrary pppd options to the root pppd process. The stated examples include adding the logfile option, and the vulnerability is rated for integrity and availability impact.

Which systems are affected and what version fixes it?

Cudy TR3000 devices running versions before 2.5.42 are affected. Upgrade to version 2.5.42 or later.

CVE-2026-129105: Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which systems are affected and what version fixes it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which systems are affected and what version fixes it?