CVE-2026-75489

Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE

View on CVE.org
Published Nov 13, 2026 CVSS 4.0 · 6.1 Medium EPSS n/a KEV · Not listed
Description
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.
Title Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE
Weaknesses CWE-345
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 13, 2026, 9:36 AM
Reserved
Aug 17, 2026, 8:07 PM

View source JSON

No data.

No data.

No data.

No data.