OS Command Injection in Cudy WR3000 Firmware

Executive Summary

CVE-2026-71961 is an OS command injection vulnerability in Cudy WR3000 2.0 routers with firmware before 2.5.24. It allows authenticated attackers to run arbitrary OS commands as root by sending unsanitized input via the mesh MQTT command interface. The sync_command binary passes this input directly to a shell execution sink in command.lua, enabling full system compromise if an attacker has MQTT broker access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the firmware version of your Cudy WR3000 router. If it is running firmware before 2.5.24, it is vulnerable. You can verify the firmware version through the router's admin interface or by checking the device's update logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain complete control over your router, allowing them to intercept network traffic, install malware, or use your device as part of a botnet. Since the attack requires authenticated access to the MQTT broker, it may be exploited remotely if credentials are weak or exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR or HIPAA requirements for data protection. Organizations using affected routers may face compliance breaches, legal penalties, and reputational damage due to potential data exposure or loss of control over network security.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware to version 2.5.24 or later. Disable the MQTT command interface if not needed. Restrict access to the MQTT broker to trusted users only. Monitor network traffic for suspicious MQTT commands.

Useful 0 Not Useful 0