TR3000 1.0 vulnerabilities
15 known vulnerabilities in TR3000 1.0 from Shenzhen Cudy Technology. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, w
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftu
- 7.2 High severity
TR3000 1.0: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns obj
- 7.2 High severity
TR3000 1.0: Improper Encoding or Escaping of Output
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject di
- 7.2 High severity
TR3000 1.0: Incomplete List of Disallowed Inputs
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the inc
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.exe
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration fi
- 8.1 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues reques
- 7.4 High severity
TR3000 1.0: Improper Neutralization of Argument Delimiters in a Command
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add opti
- 7.5 High severity
TR3000 1.0: Stack-based Buffer Overflow
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram la
- 8.1 High severity
TR3000 1.0: Improper Verification of Cryptographic Signature
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 88
- 7.5 High severity
TR3000 1.0: Missing Authentication for Critical Functionality
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycma
- 7.2 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which r
- 8.1 High severity
TR3000 1.0: Improper Neutralization of Special Elements used in an OS Command
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues r