Authentication Bypass in Cudy TR3000 via JWT None Algorithm

Executive Summary

CVE-2026-75491 is an authentication bypass flaw in Cudy TR3000 devices running firmware before 2.5.42. The vulnerability exists in the Mosquitto plugin auth_plugin_jwt.so, which incorrectly accepts unsigned JWTs using the 'alg none' algorithm. Attackers with a trusted client certificate can bypass authentication and impersonate the admin account 'admincudydevice' on port 8883. This allows them to send malicious batchcmd requests to execute arbitrary commands as root.

The flaw stems from improper verification of cryptographic signatures in JWT tokens, enabling attackers to gain full administrative control over the device.

Useful 0 Not Useful 0

Detection Guidance

Check if your Cudy TR3000 device is running firmware versions prior to 2.5.42. Inspect the Mosquitto MQTT service on port 8883 for unsigned JWT tokens using the 'alg none' algorithm. Monitor for unauthorized admincudydevice logins or batchcmd requests.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to gain root-level access to your Cudy TR3000 device. They can execute arbitrary commands, potentially taking control of your network, stealing data, or using your device for malicious activities like launching further attacks or participating in botnets.

Unauthorized access could also lead to monitoring of network traffic, interception of sensitive information, or disruption of network services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations. Unauthorized access to network devices may result in unauthorized access to personal or sensitive data, violating privacy requirements and leading to legal penalties, fines, or reputational damage.

Organizations must ensure devices are patched to maintain compliance with data protection standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Cudy TR3000 firmware to version 2.5.42 or later immediately. Disable MQTT authentication bypass by ensuring JWT verification is enforced. Restrict access to port 8883 and audit all client certificates.

Useful 0 Not Useful 0