A hard-coded JWT HMAC signing secret in the Cudy WR3000 2.0's Mosquitto MQTT authentication plugin lets unauthenticated attackers forge valid tokens and reach the router's mesh networking interface.
What Is It
CVE-2026-71960 is a use of hard-coded credentials flaw (CWE-798) in Cudy WR3000 2.0 routers running firmware before 2.5.24. The Mosquitto MQTT broker's authentication plugin signs JSON Web Tokens with an HMAC secret that is embedded in the firmware image itself. Because the secret is static and recoverable from a firmware download, an attacker who extracts it can mint arbitrary JWTs that the broker will accept as legitimate.
The result is a complete authentication bypass against the MQTT broker: no credentials, no user interaction, and no prior access to the device are required.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, with a secondary CVSS 4.0 score of 9.3 (CRITICAL). It is network-reachable, low-complexity, and requires neither privileges nor user interaction; the maximum exploitability subscore of 3.9.
Impact is rated HIGH for both confidentiality and integrity. Successful exploitation grants unauthorized access to the device's mesh networking interface, meaning an attacker can both read from and write to the messaging fabric that coordinates mesh nodes. Availability impact is rated NONE.
Neither the NVD entry nor the VulnCheck advisory states whether the embedded secret is shared across firmware builds or generated per image. If it is shared, the usual pattern for a value compiled into a vendor firmware release, extraction would be one-time work that carries over to other unpatched devices, but that should be treated as a plausible worst case rather than a confirmed property of this flaw.
What's Vulnerable
- Vendor: Shenzhen Cudy Technology Co., Ltd.
- Product: WR3000 2.0
- Affected versions: all firmware versions prior to 2.5.24 (semver, default status: affected)
The vulnerable component is specifically the authentication plugin used by the on-device Mosquitto MQTT broker.
Patch Status
Cudy has released firmware version 2.5.24, which remediates the issue. Operators of WR3000 2.0 devices should update to 2.5.24 or later via the vendor's download center. As of this writing, CVE-2026-71960 does not appear in the CISA Known Exploited Vulnerabilities catalog, and no public report of exploitation in the wild has been published by NVD or VulnCheck; the CVSS 4.0 exploit maturity is NOT_DEFINED. The record was published 2026-08-19 by VulnCheck and remains in "Received" status at NVD, so scoring and references may still change.