Threats tagged 'ghsa-3whc-7xhg-h8j2'

Cudy TR3000 devices running versions before 2.5.42 have an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so. The plugin improperly accepts unsigned JWT tokens using the 'alg none' algorithm, allowing attackers with any Cudy-trusted client certificate to authenticate as the admincudydevice user on port 8883. This enables them to publish batchcmd requests that execute commands with root privileges.