CVE-2026-129102

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection flaw in the vpn.set_conf RPC method. Authenticated administrators can exploit this by injecting newlines into the IPsec keyexchange field to append a second leftupdown directive to ipsec.conf. This allows for the execu...