Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Cudy WR3000 Hard-coded by Cudy
GCVE-1988-2026-0304
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Summary
Hello Full Disclosure list,
Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.
CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3
The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image, an attacker can forge a valid
JWT without the owner's username or password and without user
interaction.
CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface
Severity: High, CVSS 8.7
Once authenticated to MQTT, an attacker can send unsanitized input
through the mesh command interface to a shell sink, resulting in
arbitrary operating-system command execution as root.
Combined attack path:
firmware signing key -> forged JWT -> MQTT access -> root commands
Remote-scope clarification:
The attacker does not need physical proximity to the router and does
not need to be connected to the victim's LAN. Exploitation still
requires a network path to the relevant MQTT/control-plane interface.
This disclosure does not claim that every affected router is directly
reachable from the public Internet.
Affected scope:
Cudy WR3000 hardware revision 2.0
Firmware versions earlier than 2.5.24
Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There
is no defensible public estimate of the number of vulnerable devices
because neither the vendor nor public datasets provide installed-base
figures broken down by hardware revision and firmware version.
References:
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
Researcher:
Nir Yehoshua
Cipher Security Labs
https://ciphersecuritylabs.com/
Regards,
Nir Yehoshua
Cipher Security Labs
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cudy | Cudy WR3000 Hard-coded |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0304 (this record)
- related CVE-2026-71960
- related CVE-2026-71961
- related GHSA-8JMP-G7G6-GF45
- related GHSA-JW4G-PV34-HP37
{
"containers": {
"cna": {
"affected": [
{
"product": "Cudy WR3000 Hard-coded",
"vendor": "Cudy",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/68"
},
{
"url": "https://ciphersecuritylabs.com/"
},
{
"url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
},
{
"url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/68"
],
"discovery": "EXTERNAL"
},
"title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-71960",
"type": "related"
},
{
"destId": "CVE-2026-71961",
"type": "related"
},
{
"destId": "GHSA-8JMP-G7G6-GF45",
"type": "related"
},
{
"destId": "GHSA-JW4G-PV34-HP37",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0304",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
"automated": true,
"contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-19T20:23:26Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0304"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:49Z",
"dateUpdated": "2026-09-09T10:07:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0304"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0156
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Summary
Hello Full Disclosure list,
Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.
CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3
The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image, an attacker can forge a valid
JWT without the owner's username or password and without user
interaction.
CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface
Severity: High, CVSS 8.7
Once authenticated to MQTT, an attacker can send unsanitized input
through the mesh command interface to a shell sink, resulting in
arbitrary operating-system command execution as root.
Combined attack path:
firmware signing key -> forged JWT -> MQTT access -> root commands
Remote-scope clarification:
The attacker does not need physical proximity to the router and does
not need to be connected to the victim's LAN. Exploitation still
requires a network path to the relevant MQTT/control-plane interface.
This disclosure does not claim that every affected router is directly
reachable from the public Internet.
Affected scope:
Cudy WR3000 hardware revision 2.0
Firmware versions earlier than 2.5.24
Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There
is no defensible public estimate of the number of vulnerable devices
because neither the vendor nor public datasets provide installed-base
figures broken down by hardware revision and firmware version.
References:
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
Researcher:
Nir Yehoshua
Cipher Security Labs
https://ciphersecuritylabs.com/
Regards,
Nir Yehoshua
Cipher Security Labs
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cudy | Cudy WR3000 Hard-coded |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Cudy WR3000 Hard-coded",
"vendor": "Cudy",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/68"
},
{
"url": "https://ciphersecuritylabs.com/"
},
{
"url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
},
{
"url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/68"
],
"discovery": "EXTERNAL"
},
"title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0156",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
"automated": true,
"contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-19T20:23:26Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-09T10:07:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0156"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}