CVE-2026-75578

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua. The root cause is the improper handling of the remote host token from uploaded OpenVPN configuration files; the application embeds a shellquote()-quoted token int...