Threats tagged 'ghsa-9q2q-xq2j-r88v'

Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by uploading an OpenVPN configuration file with a specially crafted filename containing shell substitution characters. This filename is not properly validated and is passed to a shell command, allowing execution of arbitrary commands as root.