Security readout for executives and security teams
Plain-English summary
Affected Cudy routers contain a firmware-embedded secret that can let a network attacker impersonate an authorized user and access the mesh networking interface. Successful abuse could expose or alter sensitive device and network information. No user interaction or existing account is required.
Executive priority
Treat this as an urgent firmware and exposure-management issue. Prioritize externally or broadly reachable devices, update WR3000 units promptly, restrict management-plane access, and obtain explicit P5 guidance from Cudy. There is no supplied evidence of active exploitation, but the authentication bypass has severe potential impact.
Technical view
The Mosquitto MQTT authentication plugin uses a hard-coded HMAC secret for JWT verification. An attacker who obtains the secret from firmware can forge accepted authentication tokens and reach the mesh interface. The supplied CVSS 4.0 score is 9.3, reflecting network access, low complexity, and high confidentiality and integrity impact.
Likely exposure
WR3000 2.0 devices running firmware earlier than 2.5.24 are identified as vulnerable. The bundle also lists P5 V1.1 firmware 2.4.25, but provides no corresponding remediation threshold. Risk is greatest where MQTT or the mesh interface is reachable from untrusted networks.
Exploitation context
The source bundle describes a practical authentication-bypass condition but does not establish active exploitation. The CVE is not listed as KEV in the supplied data. Exploitation requires obtaining the embedded secret from firmware and network access to the affected MQTT service; internet exposure is not established.
Researcher notes
The bundle has a scope inconsistency: the narrative identifies WR3000 2.0 firmware before 2.5.24, while the affected list additionally names P5 V1.1 version 2.4.25. Validate both model and firmware directly. The supplied material does not clarify secret reuse across models or devices, exposure defaults, indicators of compromise, or a fixed P5 release.
Mitigation direction
- Update WR3000 2.0 devices to firmware 2.5.24 or later after confirming vendor release notes.
- Ask Cudy for P5 V1.1 remediation guidance; the supplied sources do not identify a fixed P5 version.
- Restrict MQTT and mesh-management access to trusted administrative networks.
- Isolate affected devices until firmware remediation is verified.
Validation and detection
- Inventory WR3000 2.0 and P5 V1.1 devices and record their exact firmware versions.
- Confirm whether MQTT or mesh-management services are reachable from untrusted networks.
- Review device and network logs for unexpected MQTT authentication or mesh-interface access.
- Verify the installed firmware against Cudy release notes after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-71960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Release NotesCVE reference, VulnCheck · release-notes
- https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqttCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.