---
id: "CVE-2026-129105"
page: "https://infrastack.ai/live/CVE-2026-129105"
kind: "vulnerability"
aliases: ["CVE-2026-129105"]
title: "Cudy TR3000 router: admin can inject root pppd options via L2TP credentials"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cudy-tr3000", "infrastructure", "l2tp", "routers"]
not_affected_if: ["firmware-2.5.42-or-later", "no-l2tp-wan", "non-admin-users-only"]
published_at: "2026-11-13T16:19:00+00:00"
first_seen_at: "2026-11-13T16:47:34+00:00"
updated_at: "2026-11-13T16:48:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129105", "first_seen_at": "2026-11-13T16:47:34+00:00"}]
exploit_sources: []
---

# Cudy TR3000 router: admin can inject root pppd options via L2TP credentials

Link for people: https://infrastack.ai/live/CVE-2026-129105 (this .md is for agents)

Cudy TR3000 routers before 2.5.42 let an authenticated administrator embed quotes and newlines in L2TP usernames or passwords sent to the net.set_wan method. Those values are written into a pppd options file, so an attacker can add arbitrary options to the root pppd process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the router's firmware version in the admin web interface and confirm whether it is below `2.5.42`.
- Look for L2TP WAN configuration in the router's settings; the issue only matters where L2TP is used.

## Fix

- Cudy TR3000: move to firmware `2.5.42` or later.

## Timeline

- 2026-11-13T16:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129105

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-pppd-option-injection-via-net-set-wan-l2tp-credentials

## From the sources

Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_