https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:15:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71961 <p>Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.</p> <p>Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71961 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0304 <p><strong>Affected:</strong> Cudy WR3000 Hard-coded</p> <p>Hello Full Disclosure list,</p> <p>Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24.</p> <p>CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3</p> <p>The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the secret can be recovered from the firmware image, an attacker can forge a valid JWT without the owner&#39;s username or password and without user interaction.</p> <p>CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface Severity: High, CVSS 8.7</p> <p>Once authenticated to MQTT, an attacker can send unsanitized input through the mesh command interface to a shell sink, resulting in arbitrary operating-system command execution as root.</p> <p>Combined attack path:</p> <p>firmware signing key -&gt; forged JWT -&gt; MQTT access -&gt; root commands</p> <p>Remote-scope clarification: The attacker does not need physical proximity to the router and does not need to be connected to the victim&#39;s LAN. Exploitation still requires a network path to the relevant MQTT/control-plane interface. This disclosure does not claim that every affected router is directly reachable from the public Internet.</p> <p>Affected scope: Cudy WR3000 hardware revision 2.0 Firmware versions earlier than 2.5.24</p> <p>Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There is no defensible public estimate of the number of vulnerable devices be…</p> <p><strong>Affected:</strong> Cudy WR3000 Hard-coded</p> <p>Hello Full Disclosure list,</p> <p>Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24.</p> <p>CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3</p> <p>The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the secret can be recovered from the firmware image, an attacker can forge a valid JWT without the owner&#39;s username or password and without user interaction.</p> <p>CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface Severity: High, CVSS 8.7</p> <p>Once authenticated to MQTT, an attacker can send unsanitized input through the mesh command interface to a shell sink, resulting in arbitrary operating-system command execution as root.</p> <p>Combined attack path:</p> <p>firmware signing key -&gt; forged JWT -&gt; MQTT access -&gt; root commands</p> <p>Remote-scope clarification: The attacker does not need physical proximity to the router and does not need to be connected to the victim&#39;s LAN. Exploitation still requires a network path to the relevant MQTT/control-plane interface. This disclosure does not claim that every affected router is directly reachable from the public Internet.</p> <p>Affected scope: Cudy WR3000 hardware revision 2.0 Firmware versions earlier than 2.5.24</p> <p>Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There is no defensible public estimate of the number of vulnerable devices be…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0304 https://vulnerability.circl.lu/vuln/ghsa-8jmp-g7g6-gf45 <p>Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.</p> <p>Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.</p> https://vulnerability.circl.lu/vuln/ghsa-8jmp-g7g6-gf45