Authentication Bypass in Cudy WR3000 Router Due to Hard-Coded Secrets
CVE-2026-71960

9.3CRITICAL

Key Information:

Vendor

Shenzhen Cudy Technology Co., Ltd.

Status
Wr3000 2.0
P5 V1.1
Vendor
CVE Published:
19 August 2026

What is CVE-2026-71960?

The Cudy WR3000 router, specifically versions running firmware prior to 2.5.24, has a significant security flaw stemming from a hard-coded JWT HMAC signing secret in the Mosquitto MQTT broker's authentication plugin. This vulnerability permits attackers to extract the signing secret from the firmware image, enabling them to forge valid JWT tokens. As a result, unauthorized users can gain access to the device's mesh networking interface without needing legitimate credentials, posing a severe risk to user data and system integrity.

Affected Version(s)

P5 V1.1 2.4.25 <= 2.4.27

WR3000 2.0 0

References

https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
release-notes
https://www.vulncheck.com/advisories/cudy-wr3000-hard-cod...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Yehoshua
.