by Kastro
Paper/Archive/CVE-2026-75491

CVE-2026-75491

Shenzhen Cudy Technology Co., Ltd. TR3000 1.0 — Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens

CVSS 9.2
critical.is priorityof 100
28
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.

Affected

ProductAffectedFixed inSource
TR3000 1.0< 2.5.422.5.42CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcudy.com/en-us/pages/download-center/tr3000-1-0patchd1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zipwriteupvulncheck.com/advisories/cudy-tr3000-before-2.5.42-mqtt-jwt-authentication-bypass-via-alg-none-tokens