Cudy WR3000 CVE-2026-71961

Exploitation requires authenticated access to the MQTT broker running on the Cudy WR3000 2.0 - meaning the attacker must be able to publish messages to the mesh MQTT command interface, which is described as default-enabled in the firmware. This access could be achieved via valid MQTT credentials, unauthenticated broker access if the MQTT service lacks authentication enforcement (common in consumer firmware), or by being a device already on the router's LAN or mesh network. The specific vulnerable code path runs through the sync_command binary and command.lua; no non-default configuration is required to reach it since the mesh command execution path is enabled by default. Exploitation is limited to firmware versions before 2.5.24 and to the WR3000 2.0 hardware model. The PR:L CVSS metric confirms authenticated access is a prerequisite, but the effective barrier depends heavily on how the MQTT broker is configured in practice.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the real-world risk profile. Attack complexity is low and no special attack requirements exist once MQTT broker access is obtained. The PR:L metric is critical: exploitation is gated behind authenticated access to the MQTT broker, which meaningfully constrains the attacker pool compared to a fully unauthenticated flaw. However, MQTT brokers in mesh routers are commonly accessible to any device on the LAN, and default credentials or weak authentication configurations are prevalent in consumer router firmware, potentially making this closer to a de-facto PR:N scenario in many real deployments. No EPSS data was provided, and no CISA KEV listing or POC code is confirmed, so automated at-scale exploitation is not currently evidenced. The primary realistic risk scenario is a compromised or malicious device on the same network segment, or an attacker with stolen MQTT credentials, leveraging the flaw to achieve persistent root access to the router - enabling traffic interception, DNS manipulation, or lateral movement. For organizations using Cudy WR3000 2.0 in mesh deployments, this should be treated as high priority given the trivial exploitation path after initial access.

An attacker with LAN access - such as a compromised IoT device, a rogue guest network user, or an insider - connects to the Cudy WR3000 2.0 MQTT broker and publishes a crafted message to the mesh command topic containing shell metacharacters (e.g., a semicolon-delimited OS command). The sync_command binary receives the message and forwards the unsanitized payload to command.lua, which passes it to a shell execution sink, causing the injected command to run as root. The attacker then establishes a persistent backdoor or exfiltrates credentials stored on the router. No public POC has been identified, but the injection point is described with sufficient specificity in the VulnCheck advisory that development of working exploit code would require minimal effort.