[FD] Cudy WR3000: Hard-coded JWT Secret to Root Command Injection

[Nir Yehoshua <nir@xxxxxxxxxxxxxxxxxxxxxx>]

Hello Full Disclosure list,

Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.

CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3

The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image, an attacker can forge a valid
JWT without the owner's username or password and without user
interaction.

CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface
Severity: High, CVSS 8.7

Once authenticated to MQTT, an attacker can send unsanitized input
through the mesh command interface to a shell sink, resulting in
arbitrary operating-system command execution as root.

Combined attack path:

firmware signing key -> forged JWT -> MQTT access -> root commands

Remote-scope clarification:
The attacker does not need physical proximity to the router and does
not need to be connected to the victim's LAN. Exploitation still
requires a network path to the relevant MQTT/control-plane interface.
This disclosure does not claim that every affected router is directly
reachable from the public Internet.

Affected scope:
Cudy WR3000 hardware revision 2.0
Firmware versions earlier than 2.5.24

Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There
is no defensible public estimate of the number of vulnerable devices
because neither the vendor nor public datasets provide installed-base
figures broken down by hardware revision and firmware version.

References:
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0

Researcher:
Nir Yehoshua
Cipher Security Labs
https://ciphersecuritylabs.com/

Regards,
Nir Yehoshua
Cipher Security Labs
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/