CVE-2026-75491 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 have a Mosquitto plugin that accepts unsigned JSON Web Tokens using the alg none setting. An attacker holding any Cudy-trusted client certificate can log in as the admin device on port 8883 and publish batch command requests that run as root.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Cudy TR3000 routers running firmware before 2.5.42 are exposed, and the flaw is reachable through the MQTT broker on port 8883. An attacker needs a client certificate that Cudy trusts, so devices without such access are less exposed, but the exact certificate distribution is unknown from the sources.
Not affected if firmware-2.5.42-or-later
Who cares cudy, iot, mosquitto, mqtt, routers, tr3000
2.5.42 are in the affected range.8883 is reachable from the network.2.5.42 or later.Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.