Command Injection Vulnerability in Cudy TR3000 Router

CVE-2026-129102

What is CVE-2026-129102?

The Cudy TR3000 router prior to version 2.5.42 is susceptible to a command injection vulnerability. This flaw enables authenticated administrators to execute arbitrary commands with root privileges. By manipulating the IPsec keyexchange field within the vpn.set_conf RPC method, an attacker can inject newlines, thus enabling unauthorized command execution via a second leftupdown directive in the ipsec.conf file. This can potentially be exploited when an attacker-controlled peer establishes the CHILD_SA, allowing the updown plugin of StrongSwan to run malicious commands as root.

References