Hard-Coded JWT Secret in Cudy WR3000 Firmware

Executive Summary

CVE-2026-71960 is a hard-coded JWT HMAC signing secret vulnerability in the Cudy WR3000 2.0 router's Mosquitto MQTT broker authentication plugin. Attackers can extract the secret from the firmware image and forge valid JWT tokens to bypass authentication and gain unauthorized access to the device's mesh networking interface without credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Cudy WR3000 2.0 router is running firmware versions before 2.5.24. Inspect the firmware version via the router's admin panel or SSH. If you have access to the firmware image, extract and search for hard-coded JWT secrets in the Mosquitto MQTT broker's authentication plugin files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to gain unauthorized access to the router's mesh networking interface, potentially enabling them to intercept network traffic, manipulate device settings, or launch further attacks on connected systems. The high CVSS score (9.3) indicates significant risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to network devices and data, potentially violating confidentiality requirements in GDPR and HIPAA. Unauthorized access to mesh networking interfaces may expose sensitive user data or protected health information, increasing the risk of non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router's firmware to version 2.5.24 or later from the official Cudy website. After updating, verify the firmware version and ensure no unauthorized access has occurred. Disable unnecessary MQTT services if not required for operation.

Useful 0 Not Useful 0