CVE-2026-75576: Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cudy TR3000to a version that resolves this vulnerability.Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated as an administrator and able to access the VPN client configuration upload page. Exploitation does not require user interaction.
What access does successful exploitation provide?
Commands supplied through the crafted upload filename execute as root, allowing full compromise of the affected device's confidentiality, integrity, and availability.
What upload is required to trigger the issue?
The attacker needs to upload a valid OpenVPN configuration file using a multipart filename containing $() shell substitution. The vulnerable handler passes that filename to /bin/sh -c.
Which versions are affected?
Cudy TR3000 versions before 2.5.42 are affected. Updating to version 2.5.42 or later addresses the affected version range described.