GCVE-1988-2026-0304
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Summary
Hello Full Disclosure list,
Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.
CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3
The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image, an attacker can forge a valid
JWT without the owner's username or password and without user
interaction.
CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface
Severity: High, CVSS 8.7
Once authenticated to MQTT, an attacker can send unsanitized input
through the mesh command interface to a shell sink, resulting in
arbitrary operating-system command execution as root.
Combined attack path:
firmware signing key -> forged JWT -> MQTT access -> root commands
Remote-scope clarification:
The attacker does not need physical proximity to the router and does
not need to be connected to the victim's LAN. Exploitation still
requires a network path to the relevant MQTT/control-plane interface.
This disclosure does not claim that every affected router is directly
reachable from the public Internet.
Affected scope:
Cudy WR3000 hardware revision 2.0
Firmware versions earlier than 2.5.24
Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There
is no defensible public estimate of the number of vulnerable devices
because neither the vendor nor public datasets provide installed-base
figures broken down by hardware revision and firmware version.
References:
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
Researcher:
Nir Yehoshua
Cipher Security Labs
https://ciphersecuritylabs.com/
Regards,
Nir Yehoshua
Cipher Security Labs
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Cudy | Cudy WR3000 Hard-coded |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0304 (this record)
- related CVE-2026-71960
- related CVE-2026-71961
- related GHSA-8JMP-G7G6-GF45
- related GHSA-JW4G-PV34-HP37
{
"containers": {
"cna": {
"affected": [
{
"product": "Cudy WR3000 Hard-coded",
"vendor": "Cudy",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/68"
},
{
"url": "https://ciphersecuritylabs.com/"
},
{
"url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
},
{
"url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/68"
],
"discovery": "EXTERNAL"
},
"title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-71960",
"type": "related"
},
{
"destId": "CVE-2026-71961",
"type": "related"
},
{
"destId": "GHSA-8JMP-G7G6-GF45",
"type": "related"
},
{
"destId": "GHSA-JW4G-PV34-HP37",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0304",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
"automated": true,
"contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-19T20:23:26Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0304"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:49Z",
"dateUpdated": "2026-09-09T10:07:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0304"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…