Description
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Cudy Technology | TR3000 1.0 | < 2.5.42 | 2.5.42 |
References
- Cudy TR3000 1.0 Download Center release-notes
- Cudy TR3000 Firmware 2.5.42 patch
- VulnCheck Advisory: Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload third-party-advisory