Shenzhen Cudy Technology Co Ltd
Monthly
OS command injection in the Cudy WR3000 2.0 router allows an authenticated network attacker to execute arbitrary commands with root privileges by exploiting the mesh MQTT command interface. The sync_command binary passes unsanitized attacker-controlled input directly to a shell execution sink in command.lua, and the vulnerable command execution path is enabled by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and root-level impact make this a high-priority patch target for any deployment using the mesh networking feature.
Authentication bypass in the Cudy WR3000 2.0 router (firmware before 2.5.24) lets unauthenticated remote attackers forge valid JWT tokens by reusing a hard-coded HMAC signing secret embedded in the firmware image, granting illegitimate access to the device's Mosquitto MQTT broker and mesh-networking control interface. Because the secret is static across all units of this model, any attacker who obtains one firmware image can authenticate against every deployed device. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable once the secret is extracted, and the network-reachable, no-privilege CVSS 4.0 score of 9.3 (VC:H/VI:H) reflects full read/write access to mesh control.
Remote code execution in the Cudy LT300 3.0 4G LTE router (firmware before 2.5.12) lets authenticated users run arbitrary OS commands by embedding shell metacharacters in the cbid.system.ntp.current POST parameter of the system time (NTP) configuration page. Because the CVSS 4.0 vector specifies PR:L, an attacker needs valid (low-privileged) web credentials but no user interaction, and successful injection yields full host compromise (VC/VI/VA all High). No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.
OS command injection in the Cudy WR3000 2.0 router allows an authenticated network attacker to execute arbitrary commands with root privileges by exploiting the mesh MQTT command interface. The sync_command binary passes unsanitized attacker-controlled input directly to a shell execution sink in command.lua, and the vulnerable command execution path is enabled by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and root-level impact make this a high-priority patch target for any deployment using the mesh networking feature.
Authentication bypass in the Cudy WR3000 2.0 router (firmware before 2.5.24) lets unauthenticated remote attackers forge valid JWT tokens by reusing a hard-coded HMAC signing secret embedded in the firmware image, granting illegitimate access to the device's Mosquitto MQTT broker and mesh-networking control interface. Because the secret is static across all units of this model, any attacker who obtains one firmware image can authenticate against every deployed device. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable once the secret is extracted, and the network-reachable, no-privilege CVSS 4.0 score of 9.3 (VC:H/VI:H) reflects full read/write access to mesh control.
Remote code execution in the Cudy LT300 3.0 4G LTE router (firmware before 2.5.12) lets authenticated users run arbitrary OS commands by embedding shell metacharacters in the cbid.system.ntp.current POST parameter of the system time (NTP) configuration page. Because the CVSS 4.0 vector specifies PR:L, an attacker needs valid (low-privileged) web credentials but no user interaction, and successful injection yields full host compromise (VC/VI/VA all High). No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.