CVE-2026-71961

Cudy WR3000 firmware before 2.5.24 is vulnerable: the sync_command binary passes unsanitized MQTT input to a shell sink in command.lua, allowing authenticated attackers with broker access to execute arbitrary root-level commands. CVSS 8.8 HIGH; update to firmware 2.5.24. No in-the-wild exploitati...