Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-71961Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

High 8.8

In plain English

A high-severity OS command injection in WR3000 2.0 from Shenzhen Cudy Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.7%top 14.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Affected products (as reported)

Vendor	Product	Versions
Shenzhen Cudy Technology Co., Ltd.	WR3000 2.0	0 – before 2.5.24

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
https://www.vulncheck.com/advisories/cudy-wr3000-os-command-injection-via-mesh-mqtt-command-handler third-party-advisory