{"id":"CVE-2026-129099","kind":"vulnerability","aliases":["CVE-2026-129099"],"related":[],"title":"Cudy TR3000 router: OpenVPN config import lets admins run root commands","description":"Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.","summary":"Cudy TR3000 routers before 2.5.42 accept OpenVPN client configurations whose tls-verify or ipchange directives are not filtered by an incomplete denylist. An authenticated administrator who imports a malicious config can run commands as root when the router connects to an attacker-controlled VPN endpoint.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy-tr3000","infrastructure","openvpn","routers","self-hosted"],"not_affected_if":["firmware-2.5.42-or-later","no-openvpn-client-import"],"how_to_check":"- Check the firmware version on the router's admin interface against `2.5.42`\n- Review imported OpenVPN client configurations for `tls-verify` or `ipchange` directives","fix":"- Cudy TR3000: move to `2.5.42` or later","status":"open","published_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:48:27+00:00","updated_at":"2026-11-13T16:48:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:27Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later","reach":"network","title":"Cudy TR3000 router: OpenVPN config import lets admins run root commands","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 accept OpenVPN client configurations whose tls-verify or ipchange directives are not filtered by an incomplete denylist. An authenticated administrator who imports a malicious config can run commands as root when the router connects to an attacker-controlled VPN endpoint.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","self-hosted","openvpn","routers"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"root code execution on the router by a malicious admin","analyst_note":"Product ranges are not listed in the input; the fixed version 2.5.42 comes from the title and description only.","how_to_check":"- Check the firmware version on the router's admin interface against `2.5.42`\n- Review imported OpenVPN client configurations for `tls-verify` or `ipchange` directives","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-openvpn-client-import"],"who_is_affected":"Owners and operators of Cudy TR3000 routers running firmware before 2.5.42 who use the OpenVPN client import feature. Exposure requires an administrator account on the router, so routers with no shared admin access carry less risk. Routers that do not use OpenVPN client configs are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4603,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129099':14A,17A '-2026':13A,16A '2.5.42':31B,77C 'accept':32B 'admin':8A 'administr':52B,87C 'allow':85C 'attack':70B,99C,127C 'attacker-control':69B,126C 'authent':51B,86C 'client':34B,97C 'code':81C 'command':11A,60B,91C,117C 'config':5A,57B 'configur':35B,98C 'connect':66B,123C 'contain':78C 'control':71B,128C 'cudi':1A,19B,27B,74C 'cudy-tr3000':18B 'cve':12A,15A 'denylist':49B,111C 'direct':42B,107C 'endpoint':73B,130C 'execut':82C,116C 'filter':45B,114C 'host':26B 'import':6A,54B,93C 'includ':101C 'incomplet':48B,110C 'infrastructur':21B 'ipchang':41B,106C 'let':7A 'malici':56B,95C 'openvpn':4A,22B,33B,96C 'remot':80C 'root':10A,62B,90C,119C 'router':3A,23B,29B,65B,122C 'run':9A,59B,89C 'self':25B 'self-host':24B 'tls':38B,103C 'tls-verifi':37B,102C 'tr3000':2A,20B,28B,75C 'verifi':39B,104C 'vpn':72B,129C 'vulner':83C 'whose':36B","nicknames":[],"mitigations":[],"who_affected":"Owners and operators of Cudy TR3000 routers running firmware before 2.5.42 who use the OpenVPN client import feature. Exposure requires an administrator account on the router, so routers with no shared admin access carry less risk. Routers that do not use OpenVPN client configs are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cudytr3000","high","infrastructure","openvpn","routers","selfhosted"],"campaign_type":null,"search_a":"'-129099':14A,17A '-2026':13A,16A 'admin':8A 'command':11A 'config':5A 'cudi':1A 'cve':12A,15A 'import':6A 'let':7A 'openvpn':4A 'root':10A 'router':3A 'run':9A 'tr3000':2A","search_b":"'2.5.42':31B 'accept':32B 'administr':52B 'attack':70B 'attacker-control':69B 'authent':51B 'client':34B 'command':60B 'config':57B 'configur':35B 'connect':66B 'control':71B 'cudi':19B,27B 'cudy-tr3000':18B 'denylist':49B 'direct':42B 'endpoint':73B 'filter':45B 'host':26B 'import':54B 'incomplet':48B 'infrastructur':21B 'ipchang':41B 'malici':56B 'openvpn':22B,33B 'root':62B 'router':23B,29B,65B 'run':59B 'self':25B 'self-host':24B 'tls':38B 'tls-verifi':37B 'tr3000':20B,28B 'verifi':39B 'vpn':72B 'whose':36B","search_c":"'2.5.42':77C 'administr':87C 'allow':85C 'attack':99C,127C 'attacker-control':126C 'authent':86C 'client':97C 'code':81C 'command':91C,117C 'configur':98C 'connect':123C 'contain':78C 'control':128C 'cudi':74C 'denylist':111C 'direct':107C 'endpoint':130C 'execut':82C,116C 'filter':114C 'import':93C 'includ':101C 'incomplet':110C 'ipchang':106C 'malici':95C 'openvpn':96C 'remot':80C 'root':90C,119C 'router':122C 'run':89C 'tls':103C 'tls-verifi':102C 'tr3000':75C 'verifi':104C 'vpn':129C 'vulner':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129099","severity":null,"published_at":"2026-11-13T16:18:59+00:00","modified_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null}],"documents":[{"id":147657,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-configuration-import","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}