Vulnerability-Lookup

GHSA-JW4G-PV34-HP37

Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32

Details

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-71960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T15:18:01Z",
    "severity": "CRITICAL"
  },
  "details": "Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker\u0027s authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device\u0027s mesh networking interface.",
  "id": "GHSA-jw4g-pv34-hp37",
  "modified": "2026-08-19T15:32:39Z",
  "published": "2026-08-19T15:32:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71960"
    },
    {
      "type": "WEB",
      "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-71960 (GCVE-0-2026-71960)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:27 – Updated: 2026-08-31 19:08

Title

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Summary

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:25 UTC

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://www.cudy.com/en-us/pages/download-center/…	release-notes
https://www.vulncheck.com/advisories/cudy-wr3000-…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Shenzhen Cudy Technology Co., Ltd.	WR3000 2.0	Affected: 0 , < 2.5.24 (semver)
Shenzhen Cudy Technology Co., Ltd.	P5 V1.1	Affected: 2.4.25 , ≤ 2.4.27 (semver)

Date Public

2026-07-30 00:00

Credits

Nir Yehoshua

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:25:35.305436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:25:47.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "WR3000 2.0",
          "vendor": "Shenzhen Cudy Technology Co., Ltd.",
          "versions": [
            {
              "lessThan": "2.5.24",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "P5 V1.1",
          "vendor": "Shenzhen Cudy Technology Co., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "2.4.27",
              "status": "affected",
              "version": "2.4.25",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "datePublic": "2026-07-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker\u0027s authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device\u0027s mesh networking interface."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T19:08:00.967Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-71960",
    "datePublished": "2026-08-19T14:27:57.545Z",
    "dateReserved": "2026-08-08T16:43:04.177Z",
    "dateUpdated": "2026-08-31T19:08:00.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0304

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:51

Title

Cudy WR3000: Hard-coded JWT Secret to Root Command Injection

Summary

Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24. CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3 The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the secret can be recovered from the firmware image, an attacker can forge a valid JWT without the owner's username or password and without user interaction. CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface Severity: High, CVSS 8.7 Once authenticated to MQTT, an attacker can send unsanitized input through the mesh command interface to a shell sink, resulting in arbitrary operating-system command execution as root. Combined attack path: firmware signing key -> forged JWT -> MQTT access -> root commands Remote-scope clarification: The attacker does not need physical proximity to the router and does not need to be connected to the victim's LAN. Exploitation still requires a network path to the relevant MQTT/control-plane interface. This disclosure does not claim that every affected router is directly reachable from the public Internet. Affected scope: Cudy WR3000 hardware revision 2.0 Firmware versions earlier than 2.5.24 Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There is no defensible public estimate of the number of vulnerable devices because neither the vendor nor public datasets provide installed-base figures broken down by hardware revision and firmware version. References: https://github.com/advisories/GHSA-jw4g-pv34-hp37 https://github.com/advisories/GHSA-8jmp-g7g6-gf45 https://www.cudy.com/en-us/pages/download-center/wr3000-2-0 Researcher: Nir Yehoshua Cipher Security Labs https://ciphersecuritylabs.com/ Regards, Nir Yehoshua Cipher Security Labs _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA-1988

References

8 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Aug/68	technical-description
https://ciphersecuritylabs.com/
https://github.com/advisories/GHSA-8jmp-g7g6-gf45
https://github.com/advisories/GHSA-jw4g-pv34-hp37
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/
https://www.cudy.com/en-us/pages/download-center/…

Impacted products

1 product

Vendor	Product	Version
Cudy	WR3000 Hard-coded	Affected: unknown

Credits

Nir Yehoshua

Relationships

reference GCVE-1988-2026-0304 (this record)

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "WR3000 Hard-coded",
          "vendor": "Cudy",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/68"
        },
        {
          "url": "https://ciphersecuritylabs.com/"
        },
        {
          "url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
        },
        {
          "url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/68"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-71960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-71961",
              "type": "related"
            },
            {
              "destId": "GHSA-8JMP-G7G6-GF45",
              "type": "related"
            },
            {
              "destId": "GHSA-JW4G-PV34-HP37",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0304",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
            "automated": true,
            "contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T20:23:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0304"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0304"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JW4G-PV34-HP37

CVE-2026-71960 (GCVE-0-2026-71960)

GCVE-1988-2026-0304

Tags

Sightings

Nomenclature

Related by attack behaviour