{"id":"CVE-2026-75489","kind":"vulnerability","aliases":["CVE-2026-75489"],"related":[],"title":"Cudy TR3000 router: forged mesh messages push devices onto attacker Wi-Fi","description":"Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.","summary":"Cudy TR3000 routers before 2.5.42 protect their Smart Mesh onboarding messages only with an AES key derived from public values and a CRC32 check. An adjacent attacker can forge these messages and force unpaired devices to join an attacker-controlled access point using an attacker-chosen SSID and pre-shared key.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cudy TR3000","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cudy-tr3000","infrastructure","self-hosted","smart-mesh","wifi-router"],"not_affected_if":["firmware-2.5.42-or-later","smart-mesh-disabled"],"how_to_check":"- Check the router firmware version in the Cudy web admin under system status; it is vulnerable if below `2.5.42`\n- Check whether Smart Mesh (SMT) onboarding is enabled on the device","fix":"- Cudy TR3000: move to firmware `2.5.42` or later","status":"open","published_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:54:55+00:00","updated_at":"2026-11-13T10:54:55+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:54:55Z","model":"claude-haiku-5-5","output":{"fix":"- Cudy TR3000: move to firmware `2.5.42` or later","reach":"network","title":"Cudy TR3000 router: forged mesh messages push devices onto attacker Wi-Fi","impact":"medium","summary":"Cudy TR3000 routers before 2.5.42 protect their Smart Mesh onboarding messages only with an AES key derived from public values and a CRC32 check. An adjacent attacker can forge these messages and force unpaired devices to join an attacker-controlled access point using an attacker-chosen SSID and pre-shared key.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cudy-tr3000","smart-mesh","wifi-router","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker redirects devices onto a rogue Wi-Fi network","analyst_note":"","how_to_check":"- Check the router firmware version in the Cudy web admin under system status; it is vulnerable if below `2.5.42`\n- Check whether Smart Mesh (SMT) onboarding is enabled on the device\n- unknown whether other checks are available","plain_action":"","product_name":"Cudy TR3000","needs_analyst":false,"not_affected_if":["firmware-2.5.42-or-later","smart-mesh-disabled"],"who_is_affected":"Only Cudy TR3000 routers running firmware before 2.5.42 that use Smart Mesh Technology onboarding are exposed. The attacker must be within radio range of the device, and no account is needed. Teams that do not run these routers, or that run them with a patched firmware, can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4654,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-75489':16A,19A '2.5.42':39B,92C 'access':76B,159C 'adjac':60B,128C 'ae':49B,117C 'aes-cbc':116C 'attack':10A,61B,74B,81B,130C,143C,157C 'attacker-chosen':80B,142C 'attacker-control':73B,156C 'authent':99C 'carri':140C 'cbc':118C 'check':58B,127C 'chosen':82B,144C 'contain':93C 'control':75B,158C 'crc32':57B,126C 'cudi':1A,23B,35B,89C 'cudy':20A 'cudy-tr3000':22B 'cve':14A,17A 'data':98C 'deriv':51B,120C 'devic':8A,69B,153C 'fi':13A 'forc':67B,151C 'forg':4A,63B,132C 'host':28B 'ie':139C 'infrastructur':25B 'insuffici':95C 'join':71B,155C 'key':50B,88B,119C,150C 'mesh':5A,31B,43B,106C 'messag':6A,45B,65B,112C,134C 'mt':103C 'onboard':44B,109C 'onto':9A 'point':77B,160C 'pre':86B,148C 'pre-shar':85B,147C 'probe':136C 'protect':40B,111C 'public':53B,122C 'push':7A 'request':137C 'router':3A,34B,37B 'self':27B 'self-host':26B 'share':87B,149C 'smart':30B,42B,105C 'smart-mesh':29B 'smt':108C,133C 'ssid':83B,145C 'technolog':107C 'tr3000':2A,21A,24B,36B,90C 'unauthent':129C 'unpair':68B,152C 'use':78B 'valu':54B,123C 'vendor':138C 'verif':96C 'vulner':100C 'wi':12A 'wi-fi':11A 'wifi':33B,104C 'wifi-rout':32B","nicknames":[],"mitigations":[],"who_affected":"Only Cudy TR3000 routers running firmware before 2.5.42 that use Smart Mesh Technology onboarding are exposed. The attacker must be within radio range of the device, and no account is needed. Teams that do not run these routers, or that run them with a patched firmware, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cudytr3000","tr3000"],"ptokens":["cudy","tr3000"],"labels":["cudytr3000","infrastructure","medium","selfhosted","smartmesh","vendor","wifirouter"],"campaign_type":null,"search_a":"'-2026':15A,18A '-75489':16A,19A 'attack':10A 'cudi':1A 'cudy':20A 'cve':14A,17A 'devic':8A 'fi':13A 'forg':4A 'mesh':5A 'messag':6A 'onto':9A 'push':7A 'router':3A 'tr3000':2A,21A 'wi':12A 'wi-fi':11A","search_b":"'2.5.42':39B 'access':76B 'adjac':60B 'ae':49B 'attack':61B,74B,81B 'attacker-chosen':80B 'attacker-control':73B 'check':58B 'chosen':82B 'control':75B 'crc32':57B 'cudi':23B,35B 'cudy-tr3000':22B 'deriv':51B 'devic':69B 'forc':67B 'forg':63B 'host':28B 'infrastructur':25B 'join':71B 'key':50B,88B 'mesh':31B,43B 'messag':45B,65B 'onboard':44B 'point':77B 'pre':86B 'pre-shar':85B 'protect':40B 'public':53B 'router':34B,37B 'self':27B 'self-host':26B 'share':87B 'smart':30B,42B 'smart-mesh':29B 'ssid':83B 'tr3000':24B,36B 'unpair':68B 'use':78B 'valu':54B 'wifi':33B 'wifi-rout':32B","search_c":"'2.5.42':92C 'access':159C 'adjac':128C 'ae':117C 'aes-cbc':116C 'attack':130C,143C,157C 'attacker-chosen':142C 'attacker-control':156C 'authent':99C 'carri':140C 'cbc':118C 'check':127C 'chosen':144C 'contain':93C 'control':158C 'crc32':126C 'cudi':89C 'data':98C 'deriv':120C 'devic':153C 'forc':151C 'forg':132C 'ie':139C 'insuffici':95C 'join':155C 'key':119C,150C 'mesh':106C 'messag':112C,134C 'mt':103C 'onboard':109C 'point':160C 'pre':148C 'pre-shar':147C 'probe':136C 'protect':111C 'public':122C 'request':137C 'share':149C 'smart':105C 'smt':108C,133C 'ssid':145C 'technolog':107C 'tr3000':90C 'unauthent':129C 'unpair':152C 'valu':123C 'vendor':138C 'verif':96C 'vulner':100C 'wifi':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75489","severity":null,"published_at":"2026-11-13T10:18:16+00:00","modified_at":"2026-11-13T10:18:16+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145501,"url":"https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-smt-message-forgery-via-probe-request-vendor-ie","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}