WR3000 2.0 vulnerabilities

2 known vulnerabilities in WR3000 2.0 from Shenzhen Cudy Technology. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  WR3000 2.0: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-71961Aug 19, 2026Shenzhen Cudy TechnologyEPSS 2.7%

  Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sy

• 9.1 Critical severity

  WR3000 2.0: Use of Hard-coded Credentials

  CVE-2026-71960Aug 19, 2026Shenzhen Cudy Technology

  Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the fi