An OS command injection vulnerability in Cudy WR3000 2.0 routers allows authenticated attackers to achieve remote code execution, requiring an immediate firmware update.

This is an OS command injection vulnerability (CWE-78) triggered through the mesh MQTT command handler. The vulnerability requires the attacker to have low-level user privileges to successfully execute arbitrary system commands.

Exploitation of this vulnerability allows an authenticated attacker to gain full control over the router operating system. This poses a severe threat to network security, as it could lead to unauthorized network traffic interception, pivoting into internal segments, or total device compromise. The CVSS score of 8.8 reflects the high potential for system-level impact.

Immediate Action: Update the Cudy WR3000 2.0 firmware to version 2.5.24 or the latest available release as specified by the vendor download center.

Proactive Monitoring: Monitor network traffic for anomalous MQTT command patterns or unexpected system-level processes executing on the router hardware.

Compensating Controls: Restrict access to the management interface and MQTT services to trusted internal IP addresses only, and ensure that default credentials are changed.

Public Exploit Available: No

Users and administrators of the Cudy WR3000 2.0 should update their firmware to version 2.5.24 as soon as possible. Given the risk of remote code execution, securing the device against this command injection vulnerability is essential to maintaining the integrity and confidentiality of the local network.