CVE-2026-71960 describes a critical security vulnerability in Shenzhen Cudy Technology's WR3000 2.0 router firmware versions prior to 2.5.24. The vulnerability arises from a hard-coded JWT HMAC signing secret embedded in the Mosquitto MQTT broker's authentication plugin. Attackers can extract this secret from the firmware image, enabling them to forge valid JWT tokens. This unauthorized token creation allows attackers to bypass authentication controls and access the device's mesh networking interface without valid credentials. The vulnerability has a CVSS 4.0 score of 9.3, indicating high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

Exploitation of this vulnerability allows unauthenticated attackers to gain unauthorized access to the mesh networking interface of the affected device. This could lead to unauthorized control or manipulation of the device's network functions. The high CVSS score reflects the critical nature of this access, which compromises confidentiality and integrity of the device's communications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, users should consider restricting access to the device's firmware and network interfaces to trusted parties only and monitor for updates from Shenzhen Cudy Technology regarding firmware updates addressing this issue.