CVE-2026-75578: Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated administrator of the Cudy TR3000 web interface can exploit it. Exploitation requires the ability to upload an OpenVPN client .ovpn configuration file.
What must an attacker include in the uploaded configuration?
The attacker needs to place a semicolon in the remote host token of the uploaded .ovpn file. This breaks out of the shell command construction and allows arbitrary commands to be executed as root.
Which versions are affected?
Cudy TR3000 versions before 2.5.42 are affected. Version 2.5.42 is identified as the fixed version.
What is the impact of successful exploitation?
Successful exploitation results in arbitrary command execution with root privileges on the device. This can compromise the device's confidentiality, integrity, and availability.