Wr3000 2 0
Monthly
OS command injection in the Cudy WR3000 2.0 router allows an authenticated network attacker to execute arbitrary commands with root privileges by exploiting the mesh MQTT command interface. The sync_command binary passes unsanitized attacker-controlled input directly to a shell execution sink in command.lua, and the vulnerable command execution path is enabled by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and root-level impact make this a high-priority patch target for any deployment using the mesh networking feature.
Authentication bypass in the Cudy WR3000 2.0 router (firmware before 2.5.24) lets unauthenticated remote attackers forge valid JWT tokens by reusing a hard-coded HMAC signing secret embedded in the firmware image, granting illegitimate access to the device's Mosquitto MQTT broker and mesh-networking control interface. Because the secret is static across all units of this model, any attacker who obtains one firmware image can authenticate against every deployed device. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable once the secret is extracted, and the network-reachable, no-privilege CVSS 4.0 score of 9.3 (VC:H/VI:H) reflects full read/write access to mesh control.
OS command injection in the Cudy WR3000 2.0 router allows an authenticated network attacker to execute arbitrary commands with root privileges by exploiting the mesh MQTT command interface. The sync_command binary passes unsanitized attacker-controlled input directly to a shell execution sink in command.lua, and the vulnerable command execution path is enabled by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and root-level impact make this a high-priority patch target for any deployment using the mesh networking feature.
Authentication bypass in the Cudy WR3000 2.0 router (firmware before 2.5.24) lets unauthenticated remote attackers forge valid JWT tokens by reusing a hard-coded HMAC signing secret embedded in the firmware image, granting illegitimate access to the device's Mosquitto MQTT broker and mesh-networking control interface. Because the secret is static across all units of this model, any attacker who obtains one firmware image can authenticate against every deployed device. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable once the secret is extracted, and the network-reachable, no-privilege CVSS 4.0 score of 9.3 (VC:H/VI:H) reflects full read/write access to mesh control.