CVE-2026-129105 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 let an authenticated administrator embed quotes and newlines in L2TP usernames or passwords sent to the net.set_wan method. Those values are written into a pppd options file, so an attacker can add arbitrary options to the root pppd process.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only the router's administrators can trigger this, and only where the router is set up with an L2TP WAN connection that passes credentials to pppd. Routers on firmware 2.5.42 or later are not affected. The sources do not describe whether exposure depends on remote management being enabled.
Not affected if firmware-2.5.42-or-later, no-l2tp-wan, non-admin-users-only
Who cares cudy-tr3000, l2tp, routers
2.5.42.2.5.42 or later.Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.