{"id":"CVE-2026-129100","kind":"vulnerability","aliases":["CVE-2026-129100"],"related":[],"title":"Cudy TR3000 router: admin can run commands as root via OpenVPN keys","description":"Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root.","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator upload a crafted OpenVPN private or tls-auth key that injects OpenVPN directives. OpenVPN then runs an attacker-chosen hook as root.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy","infrastructure","openvpn","routers","self-hosted","tr3000"],"not_affected_if":["firmware-2.5.42-or-later","no-admin-access-exposed"],"how_to_check":"- Check the firmware version in the router's admin web interface (System or Status page) and compare it to `2.5.42`.\n- Look for OpenVPN key or certificate upload settings and whether they are in use.","fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","status":"open","published_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:48:27+00:00","updated_at":"2026-11-13T16:48:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:27Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: admin can run commands as root via OpenVPN keys","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator upload a crafted OpenVPN private or tls-auth key that injects OpenVPN directives. OpenVPN then runs an attacker-chosen hook as root.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy","tr3000","routers","openvpn","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands as root on the router","analyst_note":"","how_to_check":"- Check the firmware version in the router's admin web interface (System or Status page) and compare it to `2.5.42`.\n- Look for OpenVPN key or certificate upload settings and whether they are in use.","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-admin-access-exposed"],"who_is_affected":"Cudy TR3000 routers running firmware before 2.5.42 are affected, and the attacker must already hold administrator credentials on the router's web interface. Routers where only trusted administrators have admin access carry lower risk, but the flaw still lets any admin escalate to root. Owners of other Cudy models or routers without this firmware line can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4605,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129100':15A,18A '-2026':14A,17A '2.5.42':31B,63C 'admin':4A 'administr':35B,73C 'allow':71C 'attack':55B,89C 'attacker-chosen':54B 'auth':44B,87C 'authent':34B,72C 'block':95C 'bypass':105C 'chosen':56B 'close':91C 'code':67C 'command':7A,76C 'contain':64C 'craft':38B,81C 'cudi':1A,19B,27B,60C 'cve':13A,16A 'denylist':108C 'direct':49B,98C 'execut':68C,75C,112C 'hook':57B,114C 'host':25B 'infrastructur':20B 'inject':47B,97C 'inlin':93C 'key':12A,45B,88C,94C 'let':32B 'openvpn':11A,21B,39B,48B,50B,82C,111C 'ovpn':107C 'privat':40B,83C 'remot':66C 'root':9A,59B,78C,116C 'router':3A,22B,29B 'run':6A,52B 'self':24B 'self-host':23B 'tls':43B,86C,102C 'tls-auth':42B,85C 'tls-verifi':101C 'tr3000':2A,26B,28B,61C 'upload':36B,80C 'verifi':103C 'via':10A 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Cudy TR3000 routers running firmware before 2.5.42 are affected, and the attacker must already hold administrator credentials on the router's web interface. Routers where only trusted administrators have admin access carry lower risk, but the flaw still lets any admin escalate to root. Owners of other Cudy models or routers without this firmware line can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin page.","pkeys":[],"ptokens":[],"labels":["cudy","high","infrastructure","openvpn","routers","selfhosted","tr3000"],"campaign_type":null,"search_a":"'-129100':15A,18A '-2026':14A,17A 'admin':4A 'command':7A 'cudi':1A 'cve':13A,16A 'key':12A 'openvpn':11A 'root':9A 'router':3A 'run':6A 'tr3000':2A 'via':10A","search_b":"'2.5.42':31B 'administr':35B 'attack':55B 'attacker-chosen':54B 'auth':44B 'authent':34B 'chosen':56B 'craft':38B 'cudi':19B,27B 'direct':49B 'hook':57B 'host':25B 'infrastructur':20B 'inject':47B 'key':45B 'let':32B 'openvpn':21B,39B,48B,50B 'privat':40B 'root':59B 'router':22B,29B 'run':52B 'self':24B 'self-host':23B 'tls':43B 'tls-auth':42B 'tr3000':26B,28B 'upload':36B","search_c":"'2.5.42':63C 'administr':73C 'allow':71C 'attack':89C 'auth':87C 'authent':72C 'block':95C 'bypass':105C 'close':91C 'code':67C 'command':76C 'contain':64C 'craft':81C 'cudi':60C 'denylist':108C 'direct':98C 'execut':68C,75C,112C 'hook':114C 'inject':97C 'inlin':93C 'key':88C,94C 'openvpn':82C,111C 'ovpn':107C 'privat':83C 'remot':66C 'root':78C,116C 'tls':86C,102C 'tls-auth':85C 'tls-verifi':101C 'tr3000':61C 'upload':80C 'verifi':103C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129100","severity":null,"published_at":"2026-11-13T16:18:59+00:00","modified_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null}],"documents":[{"id":147658,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-root-rce-via-openvpn-key-upload-injection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}