CVE-2026-129099 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 accept OpenVPN client configurations whose tls-verify or ipchange directives are not filtered by an incomplete denylist. An authenticated administrator who imports a malicious config can run commands as root when the router connects to an attacker-controlled VPN endpoint.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners and operators of Cudy TR3000 routers running firmware before 2.5.42 who use the OpenVPN client import feature. Exposure requires an administrator account on the router, so routers with no shared admin access carry less risk. Routers that do not use OpenVPN client configs are less exposed.
Not affected if firmware-2.5.42-or-later, no-openvpn-client-import
Who cares cudy-tr3000, openvpn, routers, self-hosted
2.5.42tls-verify or ipchange directives2.5.42 or laterCudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.