External risk intelligence

Cudy TR3000 JWT Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-75491

The vulnerability affects a MQTT broker (port 8883) on a Cudy router. While MQTT is a network-accessible protocol, it is primarily intended for IoT device communication and machine-to-machine messaging. It is not standard for consumer routers to expose MQTT ports directly to the public internet in common, default deployments, making internet-wide exposure possible but not the typical deployment pattern.

Authentication Bypass

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a vulnerability in Cudy routers that allows an unauthenticated attacker to bypass security controls by using a specially crafted token. This bypass could potentially enable an attacker to execute commands on the affected device with administrative privileges. The main concern is confirming if this specific technology is in use and if it is exposed externally.

An authentication bypass allows unauthorized access.
Affects routers, a common business technology.
Confirm relevance and external exposure.

Attack Path

How an attacker could exploit the issue

An attacker with any Cudy-trusted client certificate can exploit this vulnerability to bypass authentication on port 8883. This allows them to publish commands that are executed with root privileges on the device.

Requires a trusted client certificate.
Bypasses authentication via unsigned JWTs.
Enables root command execution.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability could allow an attacker with a Cudy-trusted client certificate to bypass authentication on the Mosquitto plugin and execute commands as root on the device. This occurs when the JWT authentication mechanism incorrectly accepts unsigned tokens.

Device command execution.
Bypass authentication with trusted certificate.
Unauthorized root access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership and initial actions for this vulnerability requires confirming the deployment context of the Cudy TR3000 device. The first practical step is to identify all instances of the affected device, assess their exposure to potential attackers, and confirm their business criticality. Once this inventory and risk assessment are complete, accountable owners can be identified to plan remediation, which may involve coordinating with the vendor or applying temporary risk reduction measures if immediate patching is not feasible.

Application or Infrastructure Owners.
Verify device reachability and criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Cudy TR3000 device?

The Cudy TR3000 is a networking device that functions as a router. It includes internal components like the Mosquitto MQTT broker, which handles machine-to-machine communication for IoT devices. This specific software manages messaging traffic through port 8883, serving as a gateway for connected hardware and infrastructure.

What does CWE-347 mean for CVE-2026-75491?

CWE-347 refers to the improper verification of cryptographic signatures. In this CVE, the device's authentication plugin fails to properly validate JSON Web Tokens (JWTs). Because the system incorrectly accepts tokens signed with the 'none' algorithm, it essentially ignores the requirement for a valid digital signature, allowing unauthorized access.

How can an attacker trigger this authentication bypass?

An attacker triggers the vulnerability by sending a specially crafted, unsigned JWT to the MQTT broker on port 8883. It is important to note that the exploit is not triggered by public traffic alone; the attacker must possess a Cudy-trusted client certificate to successfully initiate the connection and execute commands.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that while the vulnerability affects port 8883, this port is typically used for IoT machine-to-machine messaging rather than general internet traffic. While the vulnerability is classified as external, public exposure is not the standard default deployment pattern for these routers, suggesting many instances may not be directly reachable.

How do I respond to this Cudy TR3000 vulnerability?

Start by identifying if your organization uses the Cudy TR3000 and confirm its network placement. Verify if port 8883 is accessible from the internet or restricted to internal traffic. Once your inventory and exposure are confirmed, prioritize updating the device firmware to version 2.5.42 or later to secure the authentication mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.