Deviceways

Router

Cudy WR3000

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
REV1.0 · ESMT F50L1G41LB-104YG2M
Open hardware record
v2 · XMC XM25QH128CHIQ
Open hardware record
v1
Get OpenWrt firmware Release listed · 25.12.6
v1; V1 · XMC XM25QH128CHIQ
Open hardware record Release listed · 25.12.5
v1 · ESMT F50L1G41LB
Open hardware record Release listed · 25.12.5
v1
Open hardware record Release listed · 25.12.5
v1 · ESMT F50L1G41LB-104
Open hardware record Release listed · 25.12.5
Original project github.com
Sources

Features & details

Check the project and hardware shown for each feature.

Device details

cudy wr3000 v1 — device documentation (github.com)Cudy WR3000E v1 — TechInfoDepot (github.com)Cudy WR3000P v1 — TechInfoDepot (github.com)Cudy WR3000S v1 — TechInfoDepot (github.com)Device details — v1 — Source documentation (openwrt.org)

Hardware revision
v1

Device details

Cudy WR3000 v1 — TechInfoDepot (github.com)

Hardware revision
V1

Device details

Cudy WR3000 v2 — TechInfoDepot (github.com)

Hardware revision
v2

Device details

Cudy WR3000H — TechInfoDepot (github.com)

Hardware revision
REV1.0

OpenWrt · v1

OpenWrt · v1 — v1 — Source documentation (openwrt.org)

Availability recorded by source
Available 2025

Hardware differences

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.3 (v4.0)

WR3000 2.0

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

CVE-2026-71960

Affected firmware
Before 2.5.24
Fix
Fix details in the linked record
Read VulnCheck CVE record
Details and sources
Public disclosure CVE updated

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

Release Notes — WR3000 2.0 (cudy.com) ↗Security advisory cudy wr3000 hard coded jwt secret authentication bypass via mqtt — WR3000 2.0 (vulncheck.com) ↗
CVE published

CVSS 8.7 (v4.0)

WR3000 2.0

Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

CVE-2026-71961

Affected firmware
Before 2.5.24
Fix
Fix details in the linked record
Read VulnCheck CVE record
Details and sources
Public disclosure CVE updated

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Release Notes — WR3000 2.0 (cudy.com) ↗Security advisory cudy wr3000 os command injection via mesh mqtt command handler — WR3000 2.0 (vulncheck.com) ↗
Check more security advisories for this device · CVE.org