OS Command Injection Vulnerability in Cudy WR3000 by Cudy
CVE-2026-71961

8.7HIGH

Key Information:

Vendor

Shenzhen Cudy Technology Co., Ltd.

Status
Wr3000 2.0
Vendor
CVE Published:
19 August 2026

What is CVE-2026-71961?

The Cudy WR3000 2.0, operating on firmware versions prior to 2.5.24, is susceptible to an OS command injection flaw. This vulnerability allows authenticated users to execute arbitrary operating system commands with root privileges by sending maliciously crafted input through the mesh MQTT command interface. The sync_command binary directly forwards unsanitized input to a shell execution sink in command.lua, thereby granting attackers potential access to execute commands at the system level through the MQTT broker's default-enabled command execution path.

Affected Version(s)

WR3000 2.0 0

References

https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
release-notes
https://www.vulncheck.com/advisories/cudy-wr3000-os-comma...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Yehoshua
.