Remote Code Execution in Cudy TR3000 Devices by OpenVPN Key Injection

CVE-2026-129100

What is CVE-2026-129100?

Cudy TR3000 devices prior to version 2.5.42 are susceptible to a vulnerability that allows authenticated administrators to execute arbitrary commands with root privileges. This is achieved through the upload of malicious OpenVPN private or tls-auth keys. Attackers can manipulate the inline key block to inject custom directives, such as tls-verify, thus bypassing security filters like the .ovpn denylist. This exploitation could lead to significant security breaches if not addressed promptly.

References