Authentication Bypass Vulnerability in Cudy TR3000
CVE-2026-75491

9.2CRITICAL

Key Information:

Vendor

Shenzhen Cudy Technology Co., Ltd.

Status
Tr3000 1.0
Vendor
CVE Published:
13 November 2026

What is CVE-2026-75491?

The Cudy TR3000 device, prior to version 2.5.42, has a security flaw within the Mosquitto plugin (auth_plugin_jwt.so). This flaw allows attackers to bypass authentication checks due to the acceptance of unsigned JSON Web Tokens (JWTs) using the 'alg none' method. An attacker, armed with any Cudy-trusted client certificate, can authenticate as the admincudydevice via port 8883 and execute arbitrary commands as the root user, posing significant risks to the device's integrity. Users should promptly upgrade to the latest firmware to protect against this vulnerability.

Affected Version(s)

TR3000 1.0 0 < 2.5.42

TR3000 1.0 2.5.42

References

https://www.cudy.com/en-us/pages/download-center/tr3000-1-0
release-notes
https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_up...
patch
https://www.vulncheck.com/advisories/cudy-tr3000-before-2...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.