Mass Assignment Vulnerability in Cudy TR3000 Router

CVE-2026-129101

What is CVE-2026-129101?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to a mass assignment vulnerability in the vpn.set_conf App RPC method. This issue permits authenticated administrators to inject arbitrary OpenVPN server configurations. By exploiting this flaw, attackers can enable malicious options in the OpenVPN configuration, which can subsequently be executed with root privileges by the openvpn-hotplug wrapper through a /bin/sh command. This poses significant security risks, allowing unauthorized actions to take place within the router's operational context.

References