CUDY TR3000 · CVE-2026-75489 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 protect their Smart Mesh onboarding messages only with an AES key derived from public values and a CRC32 check. An adjacent attacker can forge these messages and force unpaired devices to join an attacker-controlled access point using an attacker-chosen SSID and pre-shared key.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only Cudy TR3000 routers running firmware before 2.5.42 that use Smart Mesh Technology onboarding are exposed. The attacker must be within radio range of the device, and no account is needed. Teams that do not run these routers, or that run them with a patched firmware, can skip it.
Not affected if firmware-2.5.42-or-later, smart-mesh-disabled
Who cares cudy-tr3000, self-hosted, smart-mesh, wifi-router
2.5.422.5.42 or laterCudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.
This page as .md · .json · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.