CVE-2026-71961: Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cudy WR3000 2.0 firmwareto a version that resolves this vulnerability.Fixed in 2.5.24 - Compensating control
Restrict MQTT broker access so only trusted, authenticated clients can publish to the mesh MQTT command handler (to prevent exploitation of the default-enabled command execution path).
Event History
Frequently Asked Questions
Which deployments are exposed?
Cudy WR3000 2.0 devices running firmware earlier than 2.5.24 are affected. The vulnerable mesh MQTT command execution path is enabled by default.
What access does an attacker need?
An attacker must be authenticated and have access to the MQTT broker. No user interaction is required, and exploitation can result in arbitrary commands executing with root privileges.
What is the impact of successful exploitation?
Successful exploitation provides root-level execution on the device, allowing compromise of confidentiality, integrity, and availability.
How can I remediate the issue?
Update affected Cudy WR3000 2.0 devices to firmware version 2.5.24 or later. The provided download center reference is the vendor source for firmware updates.