Threats tagged 'ghsa-rhq9-8pqq-xwvh'

Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability that allows authenticated administrators to execute arbitrary commands as root. This occurs via injection of newlines into the IPsec keyexchange field of the vpn.set_conf RPC method, enabling attackers to append malicious directives to the ipsec.conf file. The vulnerability leverages StrongSwan's updown plugin, which executes the appended commands with root privileges when an attacker-controlled peer establishes a CHILD_SA.