CVE-2026-75489 in TR3000
Summary
by MITRE • 11/13/2026
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Cudy TR3000 firmware versions prior to 2.5.42 represents a critical failure in the authentication mechanisms of its proprietary mt_wifi Smart Mesh Technology onboarding process. This flaw stems from an insufficient verification of data authenticity, where the protocol relies exclusively on symmetric encryption using AES-CBC and integrity checks via CRC32 for message protection. The fundamental technical deficiency lies in the derivation of the cryptographic key, which is generated solely from public values rather than a shared secret known only to legitimate devices. Because the key material is derived from information that can be observed or predicted by any device within radio range, an attacker with physical proximity to the target network possesses all necessary components to decrypt and manipulate communications intended for secure mesh formation. This architectural weakness effectively nullifies the confidentiality guarantees provided by AES-CBC, as the encryption serves only to obscure data rather than authenticate its source, leaving the system vulnerable to active manipulation of control plane messages during the critical device pairing phase.
From an operational perspective, this vulnerability allows adjacent unauthenticated attackers to forge Smart Mesh Technology messages with significant consequences for network integrity and security. Specifically, adversaries can craft malicious Probe Request vendor Information Elements that contain attacker-chosen Service Set Identifiers and pre-shared keys. When a legitimate but currently unpaired mesh node receives these forged requests, it lacks the means to verify their authenticity due to the weak key derivation scheme. Consequently, the vulnerable device may be forced to join an access point controlled by the attacker rather than its intended parent node in the mesh topology. This capability enables man-in-the-middle attacks where sensitive traffic can be intercepted, modified, or dropped. Furthermore, it allows for denial-of-service conditions by disrupting the self-healing and load-balancing capabilities of the mesh network through unauthorized device injection. The ability to inject arbitrary pre-shared keys also facilitates persistent access if those credentials are subsequently used elsewhere in a broader security ecosystem that relies on credential reuse.
This vulnerability aligns with Common Weakness Enumeration category CWE-347, which describes Improper Verification of Cryptographic Signature, as the system fails to ensure that received messages originate from trusted sources despite using cryptographic primitives. In terms of threat modeling and adversary tactics, this flaw maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle, where an attacker intercepts and potentially alters communication between two parties who believe they are directly communicating with each other. Additionally, it relates to CWE-284 Improper Access Control regarding the onboarding process, as the system does not adequately restrict which entities can initiate or influence mesh formation procedures. The reliance on CRC32 for integrity is particularly problematic because cyclic redundancy checks are designed for error detection in noisy transmission channels, not for security against malicious tampering; they offer no protection against deliberate bit-flipping attacks and can be trivially recalculated by an attacker after modifying the payload content.
Mitigation strategies must prioritize immediate firmware updates to version 2.5.42 or later, where Cudy has addressed these cryptographic deficiencies in their Smart Mesh implementation. Until patches are applied, network administrators should consider isolating mesh nodes on separate VLANs with strict access control lists that limit communication to only necessary management ports and protocols. Physical security of the deployment environment is also crucial given the adjacent attacker requirement; restricting physical access reduces the attack surface for proximity-based exploits such as this one. Furthermore, organizations deploying IoT devices like these should implement network segmentation policies that prevent compromised mesh nodes from accessing critical internal resources or other high-value assets within the enterprise perimeter. Regular auditing of connected devices and monitoring for anomalous association patterns can help detect potential exploitation attempts in real-time, providing an additional layer of defense-in-depth against this specific class of cryptographic implementation flaws.