CVE-2026-71960

This CVE exposes a JWT HMAC secret hard-coded into firmware for Cudy WR3000 devices, enabling authentication bypass in the MQTT mesh networking stack. The 9.1 CVSS is technically accurate — extracting the secret from a firmware image grants full mesh access — but it obscures two practical realities that matter more than the score itself. First, the blast radius extends beyond the compromised device. In an MQTT mesh, any node can authenticate to any other node using this same signing key. Patching one device doesn't rotate the credential across the network — the extracted secret remains valid everywhere. This is a single point of failure with lateral propagation, and if your threat model treated this as an isolated device finding, it's incomplete. Second, the EPSS score of 0.00404 reflects current exploitation activity, not exposure. For consumer IoT devices that may live unpatched on networks for years, this distinction matters. Nobody is actively hunting this CVE yet — but 50,000 devices shipped with this secret embedded in the firmware image, and the extraction technique is mature and well-documented. The EPSS tells you about threat intelligence feeds; it tells you nothing about the static population at risk. The harder question is why this happened at all. Hard-coded secrets in firmware aren't individual developer failures — they're pipeline failures. A developer building MQTT mesh functionality needs a signing key; if the build system offers no mechanism to inject secrets externally, hard-coding becomes the path of least resistance. That this secret survived into release suggests the build process had no secrets scanning, no externalized configuration pipeline, and no pre-release review targeting embedded credentials. These are the interventions that prevent recurrence — not post-hoc blame. The pattern is old. Hardcoded SSH keys in routers, AWS credentials in IP cameras, JWT secrets in smart home hubs — the exploit technique hasn't evolved in a decade, only the targets have. Each CVE gets treated as an isolated incident rather than a data point in a known failure mode. Until firmware development pipelines structurally prevent secrets from entering build artifacts, this class of vulnerability will continue to cycle through new product categories with predictable regularity.

Reviewed through automated stages and approved by a human before publication.