Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-75491. Nothing runs until you send it.
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.