Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens
Not on CISA's list of exploited flaws, and not in the news we track.
0.25%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-75491. Nothing runs until you send it.
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.
You are affected if
The fix