CVE-2026-75489: Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mtwifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.
Affected Software
Event History
Frequently Asked Questions
Which devices are realistically exposed to this attack?
Unpaired Cudy TR3000 devices running a version before 2.5.42 are exposed during mt_wifi Smart Mesh Technology onboarding. The attacker must be adjacent to the target, consistent with the adjacent-network attack vector.
Does an attacker need credentials or user interaction to exploit this?
No. The vulnerability is exploitable by an adjacent unauthenticated attacker and does not require privileges or user interaction.
What can an attacker achieve through successful exploitation?
An attacker can forge SMT messages in Probe Request vendor information elements with an attacker-chosen SSID and pre-shared key. This can force an unpaired device to join an attacker-controlled access point.
What should be done if the device cannot be updated immediately?
Keep affected devices paired rather than leaving them unpaired and avoid performing SMT onboarding where adjacent attackers may be present. Updating to version 2.5.42 or later is the identified remediation.