Threats tagged 'ghsa-fvrh-952c-4g3j'

Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by injecting commands via the WireGuard server private_key option. The vulnerability arises because the private key value is passed unsafely to a system execution function during configuration export, allowing arbitrary root command execution.