Cudy WR3000 CVE-2026-71960

Exploitation requires only network reachability to the device's Mosquitto MQTT broker and possession of the firmware-embedded JWT HMAC secret, which any attacker can extract from the freely downloadable WR3000 2.0 firmware image - no legitimate credentials, no user interaction, and no non-default configuration are needed (PR:N/UI:N/AC:L). The chief limiting factor is broker reachability: the attacker must have a network path to the MQTT service, so deployments where the broker is bound only to the LAN/mesh segment and not exposed to the WAN materially reduce practical exposure. The vulnerability is confined to the WR3000 2.0 running firmware prior to 2.5.24; patched or other-model devices are out of scope.

All primary signals point the same direction: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, zero-privilege, zero-interaction attack, and the hard-coded-secret root cause means exploitation is deterministic rather than probabilistic once the firmware is analyzed. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation is not yet confirmed - the appropriate reading is a high-impact but not-yet-observed threat rather than an active campaign; do not conflate the ease of exploitation with evidence of it happening. The shared-secret design also means a single successful extraction scales to the entire fleet of this model, so even a mid-sized municipal IT team in kalisz running a handful of these routers should treat patching as urgent rather than routine. The one nuance to verify is exposure surface: if the MQTT broker is only reachable on the LAN/mesh segment in default deployments, the practical attack vector may be adjacent-network despite the AV:N rating - confirm broker reachability from the WAN with the vendor before assuming internet-wide exploitability.

An attacker downloads the publicly available WR3000 2.0 firmware, unpacks it, and extracts the hard-coded HMAC secret from the MQTT authentication plugin. Using that secret they sign a JWT with admin-level claims and connect to the target router's Mosquitto broker over the network, which accepts the forged token as valid and grants control over the mesh networking interface - all without any credentials or user interaction. No public POC is currently identified, but the network vector and low complexity make this straightforward for a moderately skilled attacker.