External risk intelligence

Cudy WR3000 MQTT Authentication Bypass Via Hard-coded JWT Secret.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71960

The vulnerability affects an MQTT broker within a consumer router. While MQTT is often used for internal device mesh networking or local IoT communication, these ports are sometimes inadvertently exposed to the internet or reachable via misconfigured port forwarding, making it plausible but not standard practice for such interfaces to be directly internet-facing.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in Cudy WR3000 routers, specifically within the Mosquitto MQTT broker's authentication. A hard-coded secret allows attackers to bypass authentication, gain unauthorized access to the device's mesh networking, and potentially control its network functions.

Hard-coded secret allows unauthorized access.
Affects consumer routers and IoT devices.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by obtaining the firmware image for the Cudy WR3000 router. By extracting a hard-coded secret from the firmware, the attacker can then forge legitimate-looking security tokens. These forged tokens allow the attacker to bypass authentication and gain unauthorized access to the device's mesh networking capabilities.

Firmware image can be obtained.
Hard-coded secret allows forging tokens.
Gains unauthorized access to device.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to forge valid JWT tokens by extracting a hard-coded secret from the firmware. When supported by the advisory, this could lead to unauthorized access to the device's mesh networking interface.

Device mesh networking interface at risk.
Secret extracted from firmware, then tokens forged.
Unauthorized access to device network.

Operational Fix

Recommended remediation, mitigation, and detection steps

For the Cudy WR3000, ownership likely falls to the team managing the device's network infrastructure or IoT services, potentially coordinating with vendor management if the device is supplied by a third party. The first practical step is to identify all deployed WR3000 units, determine their network exposure, and assess their business criticality to prioritize remediation.

Ownership: Infrastructure or IoT management teams.
Verify first: Device presence and network reachability.
Action: Plan targeted firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Cudy WR3000?

The Cudy WR3000 is a consumer router that provides Wi-Fi and networking capabilities. It includes a mesh networking feature powered by the Mosquitto MQTT broker, which handles communication between devices in a network. This vulnerability exists within the firmware that manages these internal messaging processes.

What does CWE-798 mean for CVE-2026-71960?

CWE-798 refers to the use of hard-coded credentials. In this specific case, the firmware contains a fixed, secret key used to sign JWT authentication tokens for the MQTT broker. Because this secret is embedded directly in the device software, it is not a unique or secure key, allowing anyone who can access the firmware to discover it and impersonate authorized users.

How do attackers trigger this vulnerability?

An attacker must first obtain the device firmware image to extract the hard-coded secret. Once the secret is retrieved, the attacker can use it to craft forged JWT tokens. This process does not require access to the live device to initiate; however, the attack is only effective if the attacker can subsequently reach the router's MQTT interface to present the forged token and gain access.

Is my Cudy WR3000 at risk if it is not on the internet?

Halo Surface Signal indicates that while the affected MQTT broker is intended for local mesh or IoT communication, it may still be reachable via misconfigured port forwarding or inadvertent exposure. If your device is configured to allow traffic from the internet, the risk is higher. You should verify if the MQTT service is accessible beyond your local network boundaries.

How do I secure my router against this vulnerability?

The primary response is to update the router's firmware to version 2.5.24 or later, which addresses the issue. Start by identifying all Cudy WR3000 units in your environment and checking their current firmware version. If you cannot update immediately, ensure the device is not accessible from the internet by reviewing your network firewall and port forwarding settings.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.