Press play to start listening
Independent security researchers Hunt & Benito have released public exploit tools that reproduce a two-vulnerability chain affecting Cudy WR3000 routers. The code can extract authentication data from the router firmware, forge a valid token, and, when the required network access exists, execute operating-system commands as root.
The toolkit was published on August 20, 2026, one day after GitHub published advisories for the vulnerabilities. Its release turns the technical findings into a repeatable exploitation process, although there is no evidence that either flaw is being exploited in real attacks.
Security firm Cipher Security Labs originally discovered the vulnerabilities and handled their coordinated disclosure. Cipher did not create, commission, or publish the public exploit.
How the Public Exploit Works
The tools released by Hunt & Benito can unpack and decrypt the router firmware, recover authentication information, generate an HS256 JSON Web Token, and connect to the router’s mesh MQTT broker.
The code can then optionally chain the authentication bypass with a second vulnerability to execute commands with root privileges. An attacker does not need physical access or legitimate router credentials, but must be able to reach the MQTT control interface from their network location.
The flaws affect Cudy WR3000 routers with hardware revision 2.0 running firmware older than version 2.5.24. Cipher Security Labs has not claimed that every affected router exposes the MQTT interface directly to the internet.
Hard-Coded Secret Allows JWT Forgery
The first vulnerability, CVE-2026-71960, is rated critical with a CVSS v4 score of 9.3. It concerns a hard-coded HMAC signing secret in the router’s Mosquitto MQTT authentication plugin.
Cudy used the embedded secret to sign and verify JSON Web Tokens that authenticate users to the MQTT broker. Because the same secret can be recovered from the downloadable firmware, an attacker can use it to create a token that the router accepts as valid.
That forged token bypasses MQTT authentication and provides access to the mesh networking interface without requiring the router owner’s login credentials.
Second Vulnerability Provides Root Access
After entering the MQTT broker, an attacker can exploit CVE-2026-71961, an OS command-injection flaw rated high with a CVSS v4.0 score of 8.7.
Specially prepared input sent through a binary named sync_command reaches a Lua script called command.lua without adequate sanitization. The input then reaches a shell execution path running with root privileges.
Together, the vulnerabilities create the following route:
Firmware extraction → signing-secret recovery → forged JWT → MQTT access → root command execution
Firmware Update Removes the Vulnerable Setup
Cudy released firmware version 2.5.24 on July 30, 2026. According to Cipher Security Labs, the update removes the port 1883 listener and static authentication secret, replacing that setup with mutual TLS authentication.
Owners of WR3000 hardware revision 2.0 should install version 2.5.24 or later. Administrators should also prevent untrusted devices and networks from reaching the router’s MQTT control interface.
The public code does not prove that attackers are using the vulnerabilities against Cudy customers. As of August 24, neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog, while CISA’s enrichment record for CVE-2026-71960 lists exploitation as “none.” The released tools still remove much of the technical work previously required to reproduce the complete chain.
