{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/cudy/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-71960"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WR3000"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Cudy"],"content_html":"\u003cp\u003eCudy WR3000 2.0 routers running firmware versions prior to 2.5.24 contain a critical security vulnerability involving a hard-coded HMAC signing secret located within the Mosquitto MQTT broker authentication plugin. Because this secret is static across device deployments and embedded directly within the firmware image, an attacker who obtains the firmware can extract the key. With the secret in possession, an attacker can sign arbitrary JSON Web Tokens (JWT). By presenting these forged tokens to the MQTT broker, an attacker can bypass authentication mechanisms entirely. This allows for unauthorized access to the device's mesh networking interface, potentially leading to full control over device routing, interception of traffic, or modification of mesh network configurations. Given the ease of extraction and the severity of the access granted, this vulnerability presents a high risk for local network compromises.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker downloads the target firmware image for Cudy WR3000 from the vendor website.\u003c/li\u003e\n\u003cli\u003eAttacker uses firmware analysis tools (e.g., binwalk) to extract the file system.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the Mosquitto MQTT broker binary and its associated configuration or plugin files.\u003c/li\u003e\n\u003cli\u003eAttacker performs static analysis (e.g., strings or hex analysis) to locate the hard-coded HMAC secret within the binary.\u003c/li\u003e\n\u003cli\u003eAttacker uses a JWT library to create a forged token payload, signing it with the discovered HMAC secret.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted authentication request to the MQTT broker interface on the target router using the forged token.\u003c/li\u003e\n\u003cli\u003eThe MQTT broker validates the forged signature against the hard-coded secret and grants an authenticated session.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the mesh networking interface to monitor or reconfigure the device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass authentication on the target Cudy WR3000 device. By gaining access to the mesh networking interface, an attacker can manipulate network traffic, intercept sensitive data moving across the mesh, or leverage the device as a pivot point for further attacks on the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and IT teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Cudy WR3000 devices to firmware version 2.5.24 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, segment the management interface of the Cudy WR3000 from untrusted network segments to prevent access by unauthorized users.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic destined for the MQTT broker ports on these devices for suspicious authentication activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T16:38:48Z","date_published":"2026-08-19T16:38:15Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cudy-jwt-secret/","summary":"Cudy WR3000 routers running firmware prior to 2.5.24 contain a hard-coded HMAC secret in the Mosquitto MQTT broker plugin, enabling unauthenticated attackers to forge JWT tokens and gain unauthorized mesh interface access.","title":"Hard-Coded JWT Signing Secret in Cudy WR3000 Firmware","url":"https://feed.craftedsignal.io/briefs/2026-08-cudy-jwt-secret/"}],"language":"en","title":"CraftedSignal Threat Feed - Cudy","version":"https://jsonfeed.org/version/1.1"}