Remote Code Execution Vulnerability in Cudy TR3000 Router

CVE-2026-129099

What is CVE-2026-129099?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to a remote code execution vulnerability. Authenticated administrators can unintentionally introduce malicious OpenVPN client configurations that allow attackers to execute arbitrary root commands. This occurs when the router connects to a compromised VPN endpoint, where attackers can exploit inadequacies in the denylist, particularly involving tls-verify or ipchange directives. Proper caution is advised to mitigate this risk and ensure router configurations are secured.

References