EUVD-2026-26377Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
AnalysisAI
Cross-site request forgery in Dbit N300 T1 Pro wireless router V1.0.0 allows remote unauthenticated attackers to execute arbitrary administrative actions by convincing an authenticated administrator to visit a malicious webpage. The router lacks anti-CSRF tokens and Origin/Referer validation on configuration endpoints like /api/setWlan, enabling complete router compromise through social engineering. Publicly available exploit code exists (SSVC: poc status) with EPSS data not provided, indicating proof-of-concept demonstration but no confirmed active exploitation at time of analysis.
Technical ContextAI
CSRF (CWE-352) is a session-riding attack exploiting the automatic credential inclusion behavior of web browsers. When a user authenticates to a web application, the browser stores session cookies and automatically attaches them to all subsequent requests to that domain. Without anti-CSRF tokens (unpredictable values tied to the user session) or strict Origin/Referer header validation, the application cannot distinguish legitimate user-initiated requests from attacker-crafted requests loaded via malicious websites. The Dbit N300 T1 Pro router's web management interface at endpoints like /api/setWlan accepts state-changing administrative commands based solely on valid session cookies, with no secondary validation mechanism. This is a classic implementation flaw in embedded device web interfaces that rely exclusively on cookie-based authentication without implementing the synchronizer token pattern or SameSite cookie attributes. The CPE data provided (cpe:2.3:a:n/a:n/a) is malformed and does not identify the specific Dbit product, indicating incomplete vulnerability cataloging.
RemediationAI
No vendor-released patch identified at time of analysis - neither the Dbit vendor reference (http://dbit.com) nor the GitHub POC repository (https://github.com/kirubel-cve/CVE-2026-36956) provide fix versions or official advisories. Until a patched firmware becomes available, implement network-level compensating controls: restrict web management interface access to dedicated admin VLANs or trusted source IPs only using firewall rules or the router's built-in access control lists, blocking external network access to the management interface entirely. Configure browsers used for router administration with strict SameSite cookie policies if supported, or use isolated browser profiles/VMs exclusively for infrastructure management that never visit untrusted websites. Reduce session timeout values to minimize the exploitation window (trade-off: increased admin re-authentication). Deploy web proxy or DNS filtering to block known malicious domains for administrative workstations. These mitigations significantly reduce attack surface but do not eliminate the underlying vulnerability - administrators must maintain strict browsing hygiene during active management sessions until vendor patches are released.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today