CVE-2026-75577: Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a privatekey containing $() shell substitution and call the vpn.exportconf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as an administrator on the affected Cudy TR3000 device. The vulnerable JSON-RPC endpoint is /cgi-bin/luci/rpc/app, and exploitation does not require user interaction.
What conditions are required for exploitation?
The attacker needs to save a malicious WireGuard private_key value containing $() shell substitution, then invoke the vpn.export_conf method. The injected command is executed as root when the private key is passed to the wg pubkey shell command.
Which versions are affected?
Cudy TR3000 versions before 2.5.42 are affected. Version 2.5.42 is identified as the fixed version.
How can I determine whether a device may be vulnerable?
Check whether the device is a Cudy TR3000 running a version earlier than 2.5.42. Devices where an administrator can access the app JSON-RPC endpoint and export WireGuard configuration should be treated as exposed until updated.