Description

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T15:18:02.083Z",
  "pubdate": "2026-08-19T15:18:02.083Z",
  "executiveSummary": "An OS command injection vulnerability exists in the Cudy WR3000 2.0 router running firmware versions prior to 2.5.24. This security flaw enables authenticated threat actors to execute arbitrary operating system commands with root privileges by supplying maliciously crafted, unsanitized input via the mesh MQTT command interface. The presence of this vulnerability poses severe risk implications, as successful exploitation directly leads to a full system compromise at the highest privilege tier.\nThe affected system processes internal device communication through the mesh MQTT broker, which features a default-enabled command execution path. An attacker must possess network access to the MQTT broker and valid authentication to deliver the malicious payload. Upon successful delivery, the application logic processes the unsanitized input without proper validation or escaping, leading directly to arbitrary command execution on the underlying operating system.\nThis vulnerability highlights critical risks associated with insecure inter-process communication channels and inadequate input sanitization in embedded network devices. Immediate remediation is required to prevent unauthorized administrative control and potential lateral movement or persistent malicious activities within the local network environment.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and validation within the mesh MQTT command handling functionality of the Cudy WR3000 2.0 router. Specifically, the synchronization mechanism handled by the sync_command binary fails to properly sanitize input received from the mesh MQTT command interface before passing it further into the execution pipeline.\nDuring normal operation, the sync_command binary receives messages from the MQTT broker and forwards the contained data directly to a shell execution sink located within command.lua. Because the input lacks proper escaping or structural validation, embedded shell metacharacters or command separators are interpreted directly by the underlying command shell, resulting in arbitrary OS command injection.\nThe attack flow proceeds as follows: First, the adversary establishes network connectivity to the mesh MQTT broker and authenticates to the interface. Second, the attacker constructs a crafted MQTT message containing malicious shell commands designed to leverage the injection vector. Third, the attacker publishes this payload to the designated mesh MQTT command interface. Fourth, the sync_command binary captures the message and forwards the unsanitized input to command.lua. Finally, the shell execution sink interprets the payload, executing the attacker-supplied commands with full root privileges on the device.\nThe affected component is the mesh MQTT command processing subsystem, specifically involving the sync_command binary and the command.lua script. Affected versions include all Cudy WR3000 2.0 firmware builds prior to 2.5.24. Exploitation requires authenticated access to the MQTT broker and network exposure to the service. The post-exploitation impact is catastrophic, granting the adversary absolute root-level system compromise, full administrative control over the hardware, and the capability to manipulate network traffic, install persistent backdoors, or pivot further into connected internal segments."
}