{"id":"CVE-2026-129101","kind":"vulnerability","aliases":["CVE-2026-129101"],"related":[],"title":"Cudy TR3000 router: admin can inject OpenVPN options and run root commands","description":"Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator set arbitrary OpenVPN server options through the vpn.set_conf RPC method. Setting a malicious up option makes the openvpn-hotplug wrapper run it with /bin/sh as root.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy","infrastructure","openvpn","routers","tr3000"],"not_affected_if":["firmware-2.5.42-or-later","no-admin-access-by-others"],"how_to_check":"- Check the router firmware version in the admin web interface and compare it with `2.5.42`.\n- Confirm the device is a Cudy TR3000 before looking further.","fix":"- Cudy TR3000: move to `2.5.42` or later.","status":"open","published_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:26+00:00","updated_at":"2026-11-13T16:48:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:26Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: admin can inject OpenVPN options and run root commands","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator set arbitrary OpenVPN server options through the vpn.set_conf RPC method. Setting a malicious up option makes the openvpn-hotplug wrapper run it with /bin/sh as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy","tr3000","openvpn","routers"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"root code execution on the router by an admin account","analyst_note":"Check the Cudy firmware changelog and the VulnCheck advisory to confirm the fixed version and whether the flaw is reachable beyond the LAN.","how_to_check":"- Check the router firmware version in the admin web interface and compare it with `2.5.42`.\n- Confirm the device is a Cudy TR3000 before looking further.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["firmware-2.5.42-or-later","no-admin-access-by-others"],"who_is_affected":"Any Cudy TR3000 router running firmware before 2.5.42 is exposed to an administrator-level user who can call the vpn.set_conf method. Exposure depends on who can log in to the router's admin interface, so networks where only trusted staff hold admin credentials carry less immediate risk. Devices already on 2.5.42 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4611,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129101':15A,18A '-2026':14A,17A '/bin/sh':58B,109C '1':91C '2.5.42':28B,64C 'admin':4A 'administr':32B,80C 'allow':78C 'app':74C 'arbitrari':34B,83C 'assign':68C 'attack':87C 'authent':31B,79C 'command':12A 'conf':41B,73C 'contain':65C 'cudi':1A,19B,24B,61C 'cve':13A,16A 'enabl':90C 'execut':107C 'hotplug':53B,105C 'infrastructur':20B 'inject':6A,82C 'let':29B 'make':49B 'malici':46B,94C 'mass':67C 'method':43B,76C 'object':100C 'openvpn':7A,21B,35B,52B,84C,99C,104C 'openvpn-hotplug':51B,103C 'option':8A,37B,48B,86C,96C 'root':11A,60B,111C 'router':3A,22B,26B 'rpc':42B,75C 'run':10A,55B 'server':36B,85C 'set':33B,44B,89C 'tr3000':2A,23B,25B,62C 'via':108C 'vpn.set':40B,72C 'vulner':69C 'wrapper':54B,106C","nicknames":[],"mitigations":[],"who_affected":"Any Cudy TR3000 router running firmware before 2.5.42 is exposed to an administrator-level user who can call the vpn.set_conf method. Exposure depends on who can log in to the router's admin interface, so networks where only trusted staff hold admin credentials carry less immediate risk. Devices already on 2.5.42 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cudy","high","infrastructure","openvpn","routers","tr3000"],"campaign_type":null,"search_a":"'-129101':15A,18A '-2026':14A,17A 'admin':4A 'command':12A 'cudi':1A 'cve':13A,16A 'inject':6A 'openvpn':7A 'option':8A 'root':11A 'router':3A 'run':10A 'tr3000':2A","search_b":"'/bin/sh':58B '2.5.42':28B 'administr':32B 'arbitrari':34B 'authent':31B 'conf':41B 'cudi':19B,24B 'hotplug':53B 'infrastructur':20B 'let':29B 'make':49B 'malici':46B 'method':43B 'openvpn':21B,35B,52B 'openvpn-hotplug':51B 'option':37B,48B 'root':60B 'router':22B,26B 'rpc':42B 'run':55B 'server':36B 'set':33B,44B 'tr3000':23B,25B 'vpn.set':40B 'wrapper':54B","search_c":"'/bin/sh':109C '1':91C '2.5.42':64C 'administr':80C 'allow':78C 'app':74C 'arbitrari':83C 'assign':68C 'attack':87C 'authent':79C 'conf':73C 'contain':65C 'cudi':61C 'enabl':90C 'execut':107C 'hotplug':105C 'inject':82C 'malici':94C 'mass':67C 'method':76C 'object':100C 'openvpn':84C,99C,104C 'openvpn-hotplug':103C 'option':86C,96C 'root':111C 'rpc':75C 'server':85C 'set':89C 'tr3000':62C 'via':108C 'vpn.set':72C 'vulner':69C 'wrapper':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129101","severity":null,"published_at":"2026-11-13T16:18:59+00:00","modified_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147659,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-authenticated-rce-via-vpn-set-conf-mass-assignment","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}