The Cudy WR3000 mesh router gets rooted through a hard-coded JWT secret
Two flaws published on August 19, 2026, CVE-2026-71960 and CVE-2026-71961, let an accountless attacker forge an MQTT token and then run root commands on the Cudy WR3000 mesh router. Update to firmware 2.5.24 and take the mesh interface off your internet exposure.
August 19, 2026. Two flaws. One chain. The Cudy WR3000 2.0 mesh router carries two vulnerabilities published the same day: CVE-2026-71960, a hard-coded JWT secret rated CVSS 9.1, and CVE-2026-71961, a command injection rated CVSS 8.8. Chained together, they let an accountless attacker forge an authentication token and then run root commands on the device. The fix is firmware 2.5.24.
The weak link: a JWT secret baked into the firmware
The Cudy WR3000 is a Wi-Fi 6 mesh router: multiple units coordinate over an MQTT message bus served by the embedded Mosquitto broker. To authenticate nodes on that bus, the device uses JWT tokens signed with an HMAC key. The problem: that key is hard-coded in the firmware.
That is the textbook definition of CWE-798 (hard-coded credentials). An attacker who obtains a copy of the firmware — available from the vendor or extracted from a device — pulls out the secret, then forges valid JWT tokens from scratch. With such a token, they authenticate to the MQTT broker without ever having held a legitimate account, and reach the network’s mesh interface.
The consequence goes beyond the router itself. The MQTT bus is the backbone of the mesh: it is how nodes exchange state, configuration, and commands. Compromising that bus hands an attacker an observation and control point over the entire mesh network — not a single box.
The second stage: from forged authentication to root
The forged token is only the entry point. The second flaw, CVE-2026-71961, turns that access into full takeover. The sync_command binary, which processes commands received over the MQTT bus, forwards unsanitized input to a shell execution sink in command.lua.
This is a classic OS command injection (CWE-78). An attacker with MQTT access — which the forged token provides — can send a command containing shell metacharacters and gain execution with root privileges. The full chain reads: hard-coded secret → forged token → MQTT access → command injection → root.
An endemic pattern, not a one-off accident
What stands out is not the novelty of the flaw — it is how ordinary it is. The pairing of “hard-coded secret + unfiltered shell command” is a classic of consumer and SMB networking gear. The same week, other routers posted comparable scores: TRENDnet TEW-WLC100 (CVSS 10.0), Comfast CF-N1-S (CVSS 10.0), Wavlink WN531P3 (CVSS 10.0), or the GL.iNet range (CVSS 8.3, an authorization bypass on the WebDAV service).
The common thread: vendors who treat security as a cost constraint, firmware that is never updated after the sale, and management interfaces — here MQTT, elsewhere WebDAV or a debug telnet — exposed by default. Meshing, in particular, widens the surface: every node becomes a potential relay.
What to do
The fix is firmware 2.5.24, published by Cudy on August 19, 2026. But the patch alone does not resolve the structural exposure. Here is the order of operations:
- Update every WR3000 node to firmware 2.5.24 — a single unpatched node keeps the door open on the mesh;
- Verify the MQTT port (1883/8883) is not exposed to the internet: the mesh must stay confined to the LAN;
- Isolate IoT and guest networks on a separate VLAN, with no route to the production network;
- Rotate default secrets and disable remote-management services you do not use.
# Scan your perimeter for an exposed MQTT broker (port 1883)
nmap -p 1883,8883 --open <ip-range>
# Check the firmware version from the router's admin interface
# Administration > Firmware: version must be >= 2.5.24The firmware fixes both flaws. Segmentation, meanwhile, fixes the class of problem: a networking device with a hard-coded secret must never be reachable from the outside, patched or not.
Verdict
Treat CVE-2026-71960 and CVE-2026-71961 as full remote compromise of the router. Update to firmware 2.5.24 on every node, then confirm no mesh service is exposed to the internet. If you manage a fleet of Cudy mesh routers, treat every unpatched device as already compromised: with the secret hard-coded, exploitation requires neither skill nor prior access.
The lesson applies to all the consumer networking gear you let into your perimeter: a device whose secret is frozen in firmware is a device that cannot be secured, only isolated. Patch for the flaw, segmentation for the principle.