CVE-2026-75577

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection vulnerability via the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint. Authenticated administrators can execute commands as root by providing a malicious WireGuard private key containing $() shell...