CVE-2026-71960: Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Cudy WR3000 2.0 devices running firmware earlier than 2.5.24 are affected. The issue is in the Mosquitto MQTT broker authentication plugin used for the device's mesh networking interface.
What does an attacker need to exploit this issue?
An attacker needs the JWT HMAC signing secret embedded in the firmware image. With that secret, they can forge arbitrary valid JWTs and authenticate to the MQTT broker without legitimate credentials.
Is user interaction or prior authentication required?
No. The reported vector is network-based, with low attack complexity, no privileges required, and no user interaction required.
What should be done if a device is running an affected firmware version?
Update the device firmware to version 2.5.24 or later. The provided information does not describe a workaround if updating cannot be performed immediately.