Description
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Cudy Technology | TR3000 1.0 | < 2.5.42 | 2.5.42 |
References
- Cudy TR3000 1.0 Download Center release-notes
- Cudy TR3000 Firmware 2.5.42 patch
- VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key third-party-advisory