Data Authenticity Vulnerability in Cudy TR3000 Router

CVE-2026-75489

What is CVE-2026-75489?

The Cudy TR3000 router prior to version 2.5.42 contains a flaw in its Smart Mesh Technology onboarding process, specifically an insufficient verification of data authenticity. Attackers within the same network can exploit this vulnerability by sending specially crafted SMT messages. These messages can carry a maliciously chosen SSID and pre-shared key, potentially tricking unpaired devices into connecting to access points under the attacker's control. The vulnerability arises from the use of an AES-CBC key derived solely from public values, coupled with a basic CRC32 check, resulting in inadequate protection against message forgery.

References