CVE-2026-71960
CriticalCVSS 9.1Summary
Cudy WR3000 2.0 with firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret in the Mosquitto MQTT broker's authentication plugin. An unauthenticated attacker can extract the secret from the firmware image and forge valid JWT tokens, gaining unauthorized access to the device's mesh networking interface.
Risk Assessment
An attacker can gain full access to the MQTT broker and mesh networking interface, potentially leading to device compromise and possibly the entire mesh network.
Recommendation
Update the router firmware to version 2.5.24 or later. If possible, change the JWT secret to a random value not stored in firmware.
Original NVD description (English source)
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.