Threats tagged 'ghsa-27wf-8jj7-655w'

Cudy TR3000 devices running firmware versions before 2.5.42 have an option injection vulnerability. Authenticated administrators can exploit this flaw by injecting arbitrary pppd options through crafted L2TP credentials. This is achieved by embedding quotes and newlines in usernames or passwords submitted to the net.set_wan RPC method, which writes these inputs into a pppd options file. The vulnerability allows attackers to add options such as logfile to the root pppd process, potentially impacting system integrity and availability.