CVE-2026-75577 Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a privatekey containing $ shell substitution and call the vpn.exportconf method on the...