CVE-2026-129102 in TR3000
Summary
by MITRE • 11/13/2026
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The Cudy TR3000 router firmware prior to version 2.5.42 contains a critical command injection vulnerability within its VPN configuration interface. This flaw specifically affects authenticated administrators who possess access to the vpn.set_conf Remote Procedure Call method. The root cause of this issue lies in insufficient input validation applied to the IPsec keyexchange field. When an administrator submits configuration data, the system fails to properly sanitize special characters, particularly newline sequences, allowing for the injection of arbitrary shell commands into underlying system processes.
The technical mechanism of exploitation involves appending a second leftupdown directive to the ipsec.conf file used by StrongSwan. This configuration parameter dictates scripts that are executed during specific phases of an IPsec connection lifecycle. By injecting newlines into the keyexchange field, an attacker can manipulate this configuration file such that when a peer establishes a CHILD_SA, the updown plugin is triggered. Because these plugins operate with elevated privileges to manage network interfaces and routing tables, any command injected via this vector executes with root-level permissions on the target device.
This vulnerability represents a severe security risk as it allows for complete system compromise by an authenticated user. While the requirement of authentication might seem like a mitigating factor, in many deployment scenarios, administrative credentials may be weak, shared, or exposed through other means such as default password lists or previous credential leaks. Once exploited, the attacker gains full control over the router's operating system. This enables them to modify network configurations, intercept traffic, install persistent backdoors, pivot into internal networks protected by the router, and exfiltrate sensitive data traversing the device.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack vector leverages the execution context of system services to escalate privileges effectively. In terms of adversary behavior mapping under MITRE ATT&CK, this exploitation technique corresponds to T1059 Command and Scripting Interpreter where attackers use native tools like shell commands to execute malicious actions on compromised systems. It also relates to T1136 Creation of Account if the attacker creates new administrative users for persistence.
To mitigate this vulnerability, organizations must immediately update Cudy TR3000 routers to firmware version 2.5.42 or later where these input validation checks have been strengthened. Until updates are applied, administrators should restrict access to the management interface using strict firewall rules and ensure that strong, unique passwords are enforced for all administrative accounts. Additionally, monitoring logs for unusual VPN connection attempts or unexpected changes in ipsec.conf can help detect potential exploitation activities early. Regular vulnerability assessments and patch management cycles are essential to maintain the integrity of network infrastructure against such configuration-based injection attacks.