{"id":"CVE-2026-129105","kind":"vulnerability","aliases":["CVE-2026-129105"],"related":[],"title":"Cudy TR3000 router: admin can inject root pppd options via L2TP credentials","description":"Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator embed quotes and newlines in L2TP usernames or passwords sent to the net.set_wan method. Those values are written into a pppd options file, so an attacker can add arbitrary options to the root pppd process.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cudy-tr3000","infrastructure","l2tp","routers"],"not_affected_if":["firmware-2.5.42-or-later","no-l2tp-wan","non-admin-users-only"],"how_to_check":"- Check the router's firmware version in the admin web interface and confirm whether it is below `2.5.42`.\n- Look for L2TP WAN configuration in the router's settings; the issue only matters where L2TP is used.","fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","status":"open","published_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","triaged_at":"2026-11-13T16:48:43+00:00","updated_at":"2026-11-13T16:48:43+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:43Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later.","reach":"network","title":"Cudy TR3000 router: admin can inject root pppd options via L2TP credentials","impact":"high","summary":"Cudy TR3000 routers before 2.5.42 let an authenticated administrator embed quotes and newlines in L2TP usernames or passwords sent to the net.set_wan method. Those values are written into a pppd options file, so an attacker can add arbitrary options to the root pppd process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","routers","l2tp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"root-level command options injected into pppd on the router","analyst_note":"","how_to_check":"- Check the router's firmware version in the admin web interface and confirm whether it is below `2.5.42`.\n- Look for L2TP WAN configuration in the router's settings; the issue only matters where L2TP is used.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","no-l2tp-wan","non-admin-users-only"],"who_is_affected":"Only the router's administrators can trigger this, and only where the router is set up with an L2TP WAN connection that passes credentials to pppd. Routers on firmware 2.5.42 or later are not affected. The sources do not describe whether exposure depends on remote management being enabled.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000747,"input_tokens":4609,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129105':15A,18A '-2026':14A,17A '2.5.42':29B,73C 'add':62B,117C 'admin':4A 'administr':33B,82C 'allow':80C 'arbitrari':63B,85C 'attack':60B,96C 'authent':32B,81C 'contain':74C 'craft':99C 'credenti':12A,95C 'cudi':1A,20B,25B,70C 'cudy-tr3000':19B 'cve':13A,16A 'emb':34B 'embed':89C 'file':57B,116C 'infrastructur':22B 'inject':6A,77C,84C 'l2tp':11A,23B,39B,94C 'l2tp.sh':110C 'let':30B 'like':119C 'logfil':120C 'method':48B,108C 'net.set':46B,105C 'newlin':37B,92C 'option':9A,56B,64B,76C,87C,115C,118C 'password':42B,102C 'pppd':8A,55B,68B,86C,114C,124C 'process':69B,125C 'quot':35B,90C 'root':7A,67B,123C 'router':3A,24B,27B 'rpc':107C 'sent':43B 'submit':98C 'tr3000':2A,21B,26B,71C 'usernam':40B,100C 'valu':50B 'via':10A 'vulner':78C 'wan':47B,106C 'write':111C 'written':52B","nicknames":[],"mitigations":[],"who_affected":"Only the router's administrators can trigger this, and only where the router is set up with an L2TP WAN connection that passes credentials to pppd. Routers on firmware 2.5.42 or later are not affected. The sources do not describe whether exposure depends on remote management being enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cudytr3000","high","infrastructure","l2tp","routers"],"campaign_type":null,"search_a":"'-129105':15A,18A '-2026':14A,17A 'admin':4A 'credenti':12A 'cudi':1A 'cve':13A,16A 'inject':6A 'l2tp':11A 'option':9A 'pppd':8A 'root':7A 'router':3A 'tr3000':2A 'via':10A","search_b":"'2.5.42':29B 'add':62B 'administr':33B 'arbitrari':63B 'attack':60B 'authent':32B 'cudi':20B,25B 'cudy-tr3000':19B 'emb':34B 'file':57B 'infrastructur':22B 'l2tp':23B,39B 'let':30B 'method':48B 'net.set':46B 'newlin':37B 'option':56B,64B 'password':42B 'pppd':55B,68B 'process':69B 'quot':35B 'root':67B 'router':24B,27B 'sent':43B 'tr3000':21B,26B 'usernam':40B 'valu':50B 'wan':47B 'written':52B","search_c":"'2.5.42':73C 'add':117C 'administr':82C 'allow':80C 'arbitrari':85C 'attack':96C 'authent':81C 'contain':74C 'craft':99C 'credenti':95C 'cudi':70C 'embed':89C 'file':116C 'inject':77C,84C 'l2tp':94C 'l2tp.sh':110C 'like':119C 'logfil':120C 'method':108C 'net.set':105C 'newlin':92C 'option':76C,87C,115C,118C 'password':102C 'pppd':86C,114C,124C 'process':125C 'quot':90C 'root':123C 'rpc':107C 'submit':98C 'tr3000':71C 'usernam':100C 'vulner':78C 'wan':106C 'write':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129105","severity":null,"published_at":"2026-11-13T16:19:00+00:00","modified_at":"2026-11-13T16:19:00+00:00","first_seen_at":"2026-11-13T16:47:34+00:00","fetched_at":"2026-11-13T16:47:34+00:00","note":null}],"documents":[{"id":147663,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-pppd-option-injection-via-net-set-wan-l2tp-credentials","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}