CyberRota Analysis
AI-GeneratedThe Cudy WR3000 2.0 router running firmware versions prior to 2.5.24 is vulnerable to an OS command injection flaw that permits authenticated attackers to execute arbitrary commands with root privileges via the mesh MQTT command interface. This vulnerability allows attackers with access to the MQTT broker to exploit unsanitized input, potentially leading to complete system compromise. Organizations using this router model should prioritize patching to mitigate the risk of unauthorized access and control over their network infrastructure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.