{"id":"CVE-2026-129102","kind":"vulnerability","aliases":["CVE-2026-129102"],"related":[],"title":"Cudy TR3000 router: authenticated admins run commands as root via VPN settings","description":"Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator inject newlines into the IPsec keyexchange field of the vpn.set_conf RPC, adding a second leftupdown directive to ipsec.conf. StrongSwan then runs that injected command as root when a peer establishes a CHILD_SA, so an attacker gets root on the device.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy","infrastructure","ipsec","router","self-hosted","strongswan","tr3000"],"not_affected_if":["auth-required","firmware-2.5.42-or-later"],"how_to_check":"- Check the firmware version in the router's admin interface (System or Status page) and compare it with `2.5.42`.\n- Confirm whether IPsec VPN is enabled on the device; the sources do not name a specific setting that disables the path.","fix":"- Cudy TR3000: move to `2.5.42` or later.","status":"open","published_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:26+00:00","updated_at":"2026-11-13T16:48:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:26Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: authenticated admins run commands as root via VPN settings","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator inject newlines into the IPsec keyexchange field of the vpn.set_conf RPC, adding a second leftupdown directive to ipsec.conf. StrongSwan then runs that injected command as root when a peer establishes a CHILD_SA, so an attacker gets root on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["cudy","tr3000","router","ipsec","strongswan","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands as root on the router.","analyst_note":"Confirm from the vulncheck advisory whether IPsec must be enabled for vpn.set_conf to be reachable.","how_to_check":"- Check the firmware version in the router's admin interface (System or Status page) and compare it with `2.5.42`.\n- Confirm whether IPsec VPN is enabled on the device; the sources do not name a specific setting that disables the path.","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin settings.","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","auth-required"],"who_is_affected":"Cudy TR3000 routers running firmware before 2.5.42 that expose the IPsec VPN feature are exposed; the attack needs an administrator login first. Routers with no admin credentials at risk, or with the VPN feature unused, are less exposed; the sources do not say whether VPN must be enabled for the RPC to be reachable.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0008,"input_tokens":4619,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129102':15A,18A '-2026':14A,17A '2.5.42':32B,82C 'add':49B 'admin':5A 'administr':36B,91C 'allow':89C 'append':113C 'attack':73B,111C,131C 'attacker-control':130C 'authent':4A,35B,90C 'child':69B,136C 'command':7A,61B,85C,94C 'conf':47B,108C 'contain':83C 'control':132C 'cudi':1A,19B,28B,79C 'cve':13A,16A 'devic':78B 'direct':53B,117C 'establish':67B,134C 'execut':93C 'field':43B,104C 'get':74B 'host':25B 'infrastructur':20B 'inject':37B,60B,86C,98C 'ipsec':21B,41B,102C 'ipsec.conf':55B,119C 'keyexchang':42B,103C 'leftupdown':52B,116C 'let':33B 'method':110C 'newlin':38B,99C 'peer':66B,133C 'plugin':124C 'root':9A,63B,75B,96C,127C 'router':3A,22B,30B 'rpc':48B,109C 'run':6A,58B,125C 'sa':70B,137C 'second':51B,115C 'self':24B 'self-host':23B 'set':12A 'strongswan':26B,56B,121C 'tr3000':2A,27B,29B,80C 'updown':123C 'via':10A 'vpn':11A 'vpn.set':46B,107C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Cudy TR3000 routers running firmware before 2.5.42 that expose the IPsec VPN feature are exposed; the attack needs an administrator login first. Routers with no admin credentials at risk, or with the VPN feature unused, are less exposed; the sources do not say whether VPN must be enabled for the RPC to be reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your Cudy TR3000 router to firmware 2.5.42 or later through its admin settings.","pkeys":[],"ptokens":[],"labels":["cudy","high","infrastructure","ipsec","router","selfhosted","strongswan","tr3000"],"campaign_type":null,"search_a":"'-129102':15A,18A '-2026':14A,17A 'admin':5A 'authent':4A 'command':7A 'cudi':1A 'cve':13A,16A 'root':9A 'router':3A 'run':6A 'set':12A 'tr3000':2A 'via':10A 'vpn':11A","search_b":"'2.5.42':32B 'add':49B 'administr':36B 'attack':73B 'authent':35B 'child':69B 'command':61B 'conf':47B 'cudi':19B,28B 'devic':78B 'direct':53B 'establish':67B 'field':43B 'get':74B 'host':25B 'infrastructur':20B 'inject':37B,60B 'ipsec':21B,41B 'ipsec.conf':55B 'keyexchang':42B 'leftupdown':52B 'let':33B 'newlin':38B 'peer':66B 'root':63B,75B 'router':22B,30B 'rpc':48B 'run':58B 'sa':70B 'second':51B 'self':24B 'self-host':23B 'strongswan':26B,56B 'tr3000':27B,29B 'vpn.set':46B","search_c":"'2.5.42':82C 'administr':91C 'allow':89C 'append':113C 'attack':111C,131C 'attacker-control':130C 'authent':90C 'child':136C 'command':85C,94C 'conf':108C 'contain':83C 'control':132C 'cudi':79C 'direct':117C 'establish':134C 'execut':93C 'field':104C 'inject':86C,98C 'ipsec':102C 'ipsec.conf':119C 'keyexchang':103C 'leftupdown':116C 'method':110C 'newlin':99C 'peer':133C 'plugin':124C 'root':96C,127C 'rpc':109C 'run':125C 'sa':137C 'second':115C 'strongswan':121C 'tr3000':80C 'updown':123C 'vpn.set':107C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:18:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129102","severity":null,"published_at":"2026-11-13T16:18:59+00:00","modified_at":"2026-11-13T16:18:59+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147660,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-command-injection-via-vpn-set-conf-ipsec-keyexchange","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}