Public exploit code targets Cudy router flaw chain

Public exploit tooling has been released for a critical vulnerability chain affecting Cudy WR3000 revision 2.0 routers. The code shows a path from forged authentication to root command execution.

The vulnerabilities affect WR3000 hardware revision 2.0 running firmware earlier than version 2.5.24. Cipher Security Labs said an independent research team, Hunt & Benito, published code implementing the attack path after disclosure.

The chain combines two flaws tracked as CVE-2026-71960 and CVE-2026-71961. The first, rated critical with a CVSS v4 score of 9.3, involves a hard-coded HMAC signing secret used by the router's Mosquitto MQTT broker JWT authentication plugin. The second, rated high with a CVSS v4 score of 8.7, is an OS command injection flaw in the mesh MQTT command handler.

Together, the flaws let an attacker forge a JSON Web Token accepted by the router, access the mesh MQTT broker and send input to a command path that can execute operating-system commands with root privileges. Cipher Security Labs said the sequence involves recovering signing material, creating a forged token, accessing MQTT and delivering command input through the sync_command path.

The release of public code moves the issue beyond a research finding and makes it easier for others to reproduce. The published package includes tools to unpack firmware, recover device data used by the authentication flow, generate an HS256 token, connect to the broker, subscribe to management traffic and optionally trigger the command path tied to the second vulnerability.

That does not mean attacks are already under way. The researchers said they had not verified evidence of active exploitation and were not claiming that every vulnerable router was exposed to the public internet.

A network path to the MQTT or mesh control interface is still required. That could come from direct exposure, unintended port forwarding, configuration mistakes, an upstream network position, another compromised system or internal access to a reachable management service.

In practice, an attacker does not need legitimate router credentials, physical proximity to the device or user interaction if the relevant service is reachable. The issue therefore hinges on both patching and limiting access to management interfaces.

"Public exploit tooling changes the operational risk even when there is no evidence of active abuse," said Nir Yehoshua, Founder and Lead Researcher at Cipher Security Labs.

"The attack path is no longer split across an advisory and reverse-engineering notes. It is now represented in code that shows how authentication can be forged and how that access can be carried forward to the privileged command interface," Yehoshua said.

Attribution dispute

Cipher Security Labs drew a distinction between the original vulnerability research and the exploit release. It said it discovered the vulnerabilities and coordinated disclosure, while Hunt & Benito independently developed and published the tooling.

The distinction matters because vulnerability disclosures can blur the line between defensive research and operational exploit code. In this case, Cipher Security Labs said it neither created nor contributed to the published repository.

"Attribution matters in vulnerability reporting," Yehoshua said.

"Cipher Security Labs discovered the vulnerabilities and handled vendor coordination, but we did not release this exploit. Hunt & Benito produced the tooling independently. That third-party implementation is newsworthy because it materially lowers the work required to reproduce the chain, while remaining separate from our coordinated disclosure process," Yehoshua said.

Affected scope

The findings are narrowly defined. Cipher Security Labs said they apply to WR3000 hardware revision 2.0 with firmware earlier than 2.5.24 and should not be assumed to affect revision 1.0, revision 3.0 or other Cudy products without separate evidence.

The vendor lists firmware version 2.5.24 for WR3000 revision 2.0. Users have been advised to verify the hardware revision shown on the device or in the administration interface before installing an update intended for that exact model revision.

The researchers said they analysed authentic firmware binaries and carried out controlled component-level testing in an ARM32 emulation environment. They reproduced forged-token acceptance and root command output at component level, but did not complete an end-to-end exploit against a physical WR3000 revision 2.0 over the production TLS listener with a live mesh topology.

That testing boundary helps explain why the affected range is described conservatively as firmware earlier than 2.5.24. It also underlines that the technical findings are based on verified analysis, while deployment details in live environments may vary.

Mitigation steps

Administrators should ensure that MQTT, router administration and mesh management services are not reachable from untrusted networks, the researchers said. They also advised removing unintended port forwarding, restricting management access to trusted network segments, separating guest devices from network infrastructure and reviewing routers for unexpected changes to DNS, firewall, routing, wireless and administrator settings.

A successful root compromise on a router can extend well beyond the device itself. Control of a network gateway can allow changes to name resolution, firewall policy, traffic routing, wireless settings or persistent startup behaviour, creating opportunities for disruption, traffic redirection, surveillance or access to sensitive configuration data.

"The right message is urgent but precise," Yehoshua said.

"Public code substantially reduces the technical barrier, but it does not eliminate the network-reachability requirement and it does not establish exploitation in the wild. Defenders should treat the release as a reason to patch and restrict management access now, not as permission to overstate what has been observed," Yehoshua said.

"Network edge devices protect every system behind them," Yehoshua said.

"Their security must assume that firmware can be downloaded and inspected. Authentication should not depend on reusable embedded secrets, and data received from an authenticated management channel must still be treated as untrusted before it can reach a shell," Yehoshua said.