Threats tagged 'ghsa-5r2m-3p47-vjwj'

Cudy TR3000 devices running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by uploading specially crafted OpenVPN private or tls-auth keys. The attack involves closing the inline key block prematurely and injecting directives that bypass security restrictions, allowing OpenVPN to execute arbitrary commands as root.