CVE-2026-75491: Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin authpluginjwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.
Affected Software
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker needs any client certificate trusted by Cudy. No prior account or user interaction is required, but exploitation also requires crafting an unsigned JWT with the alg none algorithm.
Which service and identity are involved in exploitation?
The vulnerable authentication path is the Mosquitto MQTT service on port 8883, through auth_plugin_jwt.so. A successful attacker can authenticate as admincudydevice and publish batchcmd requests.
What is the impact after successful authentication?
Publishing batchcmd requests allows the attacker to execute commands as root on the affected device. This can compromise confidentiality, integrity, and availability.
Which versions should be remediated?
Cudy TR3000 versions before 2.5.42 are affected. Upgrade to version 2.5.42 or later.