CVE-2026-129100 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 let an authenticated administrator upload a crafted OpenVPN private or tls-auth key that injects OpenVPN directives. OpenVPN then runs an attacker-chosen hook as root.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Cudy TR3000 routers running firmware before 2.5.42 are affected, and the attacker must already hold administrator credentials on the router's web interface. Routers where only trusted administrators have admin access carry lower risk, but the flaw still lets any admin escalate to root. Owners of other Cudy models or routers without this firmware line can skip it.
Not affected if firmware-2.5.42-or-later, no-admin-access-exposed
Who cares cudy, openvpn, routers, self-hosted, tr3000
2.5.42.2.5.42 or later.Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.