EUVD-2026-125448

Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.setconf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper...

EUVD-2026-125447

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.setconf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which...

CVE-2026-129102

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection flaw in the vpn.set_conf RPC method. Authenticated administrators can exploit this by injecting newlines into the IPsec keyexchange field to append a second leftupdown directive to ipsec.conf. This allows for the execu...

CVE-2026-129101

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a mass assignment vulnerability within the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options . Specifically, an attacker can set enabled=1 and provide a malicious up opti...