VULNARCHIVE

GCVE-1988-2026-0304

Cudy WR3000: Hard-coded JWT Secret to Root Command Injection

Description (en)

Hello Full Disclosure list,

Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.

CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3

The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image, an attacker can forge a valid
JWT without the owner's username or password and without user
interaction.

CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface
Severity: High, CVSS 8.7

Once authenticated to MQTT, an attacker can send unsanitized input
through the mesh command interface to a shell sink, resulting in
arbitrary operating-system command execution as root.

Combined attack path:

firmware signing key -> forged JWT -> MQTT access -> root commands

Remote-scope clarification:
The attacker does not need physical proximity to the router and does
not need to be connected to the victim's LAN. Exploitation still
requires a network path to the relevant MQTT/control-plane interface.
This disclosure does not claim that every affected router is directly
reachable from the public Internet.

Affected scope:
Cudy WR3000 hardware revision 2.0
Firmware versions earlier than 2.5.24

Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There
is no defensible public estimate of the number of vulnerable devices
because neither the vendor nor public datasets provide installed-base
figures broken down by hardware revision and firmware version.

References:
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0

Researcher:
Nir Yehoshua
Cipher Security Labs
https://ciphersecuritylabs.com/

Regards,
Nir Yehoshua
Cipher Security Labs
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "WR3000 Hard-coded",
          "vendor": "Cudy",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner's username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -> forged JWT -> MQTT access -> root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim's LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/68"
        },
        {
          "url": "https://ciphersecuritylabs.com/"
        },
        {
          "url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
        },
        {
          "url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/68"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-71960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-71961",
              "type": "related"
            },
            {
              "destId": "GHSA-8JMP-G7G6-GF45",
              "type": "related"
            },
            {
              "destId": "GHSA-JW4G-PV34-HP37",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0304",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
            "automated": true,
            "contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T20:23:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0304"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}