EUVD-2025-211036
GHSA-rmvf-vpmv-h9w6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin local Wi-Fi network
-
ExploitSend malformed /api/login request
-
ExecutionTrigger JSON parser error
-
ImpactCrash management interface
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The attacker must be connected to the device's local Wi-Fi network (adjacent access, not internet-reachable) and send an HTTP request to the /api/login endpoint of a Dbit WIFI4 N300 1.0.0 router with the username or password field absent, which the flawed JSON parser fails to handle and crashes the management interface. No authentication is required (CVSS PR:N). Limiting factors: exploitation requires Wi-Fi proximity/association to the target network rather than remote internet access, and the realized effect is limited to denial of service of the management interface - there is no described path to data disclosure or code execution. |
| Impact | The input CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) significantly overstates real-world risk and conflicts with the description. The description and the 'Denial Of Service' tag describe only a crash of the management interface caused by a JSON parser error - there is no evidence of confidentiality or integrity loss, so C:H and I:H are not supported by the facts; the realistic impact is availability only. Additionally, the vector claims AV:N (network) but the description explicitly states the triggering request comes 'from the local Wi-Fi network,' which is adjacent access (AV:A), not internet-reachable. Supporting signals point to low priority: EPSS is 0.15% (4th percentile), there is no CISA KEV listing (not actively exploited), and no POC flag is set in the input. The one referenced blog ('Anatomy of an IoT Exploit') appears to be a security-research writeup rather than confirmed weaponized exploit code. Net assessment: this is a high-CVSS-but-low-real-risk issue - an adjacent-network denial-of-service against an obscure consumer router, not a priority remote-code-execution threat. The CVSS score should be re-verified with the vendor given the DoS-only impact and local-Wi-Fi access constraint. |
| Exploit ScenarioDerived | An attacker already connected to the device's local Wi-Fi network sends a crafted HTTP request to the /api/login endpoint that omits the username or password field, triggering a JSON parser error that crashes the router's management interface and denies administrative access. No authentication is required (PR:N), and attack complexity is low, but exploitation is bounded to attackers within Wi-Fi range. No confirmed public exploit code is present in the input, though a referenced research blog appears to document the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in the Dbit WIFI4 N300 1.0.0 router allows an attacker who is already associated with the device's local Wi-Fi network to crash its management interface by sending an HTTP request to the /api/login endpoint that omits the username or password field, which the device's JSON parser cannot handle. No authentication is required (CVSS PR:N), but exploitation demands Wi-Fi adjacency/association rather than internet reachability, and the realized effect is limited to loss of availability of the web management interface - there is no described path to data disclosure or code execution. The input CVSS 3.1 base score of 9.8 (AV:N/.../C:H/I:H/A:H) substantially overstates real-world risk; our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and EPSS is very low at 0.15% (4th percentile), with no public exploit and no CISA KEV listing identified at time of analysis.
RemediationAI
No vendor-released patch was identified in the available intelligence for CVE-2025-71383, so remediation must rely on compensating controls until Dbit publishes firmware. The primary control is network segmentation: place Dbit WIFI4 N300 1.0.0 devices on an isolated IoT/guest VLAN or SSID with client isolation enabled, so that only trusted administrative hosts can reach the /api/login endpoint; the trade-off is that IoT devices may lose LAN access to other services (printers, NAS, home automation hubs) and may require mDNS/relay exceptions. Second, enforce strong WPA2/WPA3-Personal (or WPA2/WPA3-Enterprise) with a non-shared passphrase and rotate credentials, since any associated client - including a compromised guest device - can trigger the crash; note that WPA3 transition mode can cause compatibility problems with older clients. Third, restrict management access by disabling remote/WAN administration, binding the management UI to a single wired administrator address where the hardware supports it, and using an upstream firewall/AP rule set to drop traffic destined to the router's management port from wireless clients; the trade-off is reduced administrative flexibility. Fourth, monitor the device for management-interface unavailability or unexpected reboots, and treat repeated crashes as evidence of attempted exploitation. Because no upstream fix version is confirmed, verify with the vendor (or the Klogix Scorpion Labs research referenced in the advisory at https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux) whether a fixed firmware release exists before rolling out, and if the device is end-of-support with no patch path, plan hardware replacement.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-20 (Improper Input Validation) and manifests inside the JSON parsing routine that processes requests to the /api/login endpoint of the Dbit WIFI4 N300 1.0.0 firmware. When a request body arrives without the expected 'username' or 'password' field, the parser does not gracefully handle the missing keys and the resulting error state crashes the management interface, rendering the device's administrative web UI unavailable until it recovers or is restarted. The underlying technology is a consumer-grade 802.11 Wi-Fi router (WIFI 4 / 802.11n, N300 class) exposing a local HTTP-based management API; the attack surface is therefore the local wireless segment rather than the public internet. The supplied CPE string is a non-specific placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and provides no additional product granularity, and the ENISA EUVD record likewise lists affected versions as 'n/a n/a', so the only confirmed affected version is 1.0.0 as stated in the description. Root cause is best understood as missing null/absent-field handling (a parser robustness defect) rather than a memory-safety issue: the impact chain terminates at availability loss, consistent with the assessed C:N/I:N/A:H vector.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Request originates from the local Wi-Fi network so AV:A not AV:N; no auth needed (PR:N); description shows only a crash, so C:N/I:N and A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.
Executive ViewAI
The Dbit WIFI4 N300 1.0.0 router can have its web management interface crashed by an unauthenticated attacker who is already associated with the device's Wi-Fi network, causing loss of management availability but with no described path to data disclosure or code execution. No vendor-released patch has been identified at time of analysis, so organizations running these devices should treat this as an availability and asset-lifecycle problem driven by local wireless exposure rather than an urgent compromise scenario. Leadership should care primarily because affected units are typically distributed across branch, retail, or remote sites where the Wi-Fi network may be reachable by guests, contractors, or customers.
No vendor patch is available, so rely on interim mitigations: restrict Wi-Fi association to trusted users with strong WPA2/WPA3 credentials and rotate the pre-shared key; segment the router's management interface onto an isolated management VLAN and limit administrative access to IT source addresses; disable WAN-side, cloud, and remote administration; change default administrator credentials; monitor for repeated malformed POSTs to /api/login or unexplained management-interface outages to detect abuse; and plan replacement or re-segmentation of Dbit WIFI4 N300 1.0.0 devices if the vendor does not provide a firmware fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB