EUVD-2026-26378Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. By initiating a high-volume flood of HTTP GET requests to non-existent URIs, an attacker can exhaust critical system resources, including file descriptors and memory buffers. This results in a kernel deadlock or system hang that disables the web management portal and all routing capabilities.
AnalysisAI
Remote attackers can crash Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 and disable all routing functionality by flooding the boa web server with HTTP GET requests to non-existent URIs. The attack exhausts file descriptors and memory buffers, causing kernel deadlock that kills both the web management interface and core routing services. SSVC framework confirms proof-of-concept exploit exists and the attack is fully automatable against default router configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N).
Technical ContextAI
The vulnerability resides in the boa web server, a lightweight HTTP daemon commonly embedded in consumer networking devices. Boa's URI handler in this firmware version (V1.0.0) lacks proper resource limits when processing requests to non-existent paths. The CWE-400 (Uncontrolled Resource Consumption) flaw allows unbounded allocation of file descriptors and memory buffers during error handling for 404 responses. Because boa runs with kernel-level privileges in typical embedded router architectures, resource exhaustion cascades into kernel space, triggering a deadlock condition rather than graceful degradation. The CPE string is generic (cpe:2.3:a:n/a:n/a), indicating limited vendor participation in NVD cataloging, but the specific affected product is the Dbit N300 T1 Pro wireless router running firmware V1.0.0.
RemediationAI
No vendor-released firmware patch has been identified at the time of analysis. Users should implement immediate compensating controls: Disable external access to the web management interface (typically TCP port 80/443) via router firewall rules, restricting admin access to trusted internal IP ranges only. Configure upstream network firewall or ISP router to block inbound HTTP/HTTPS traffic to the Dbit router's WAN interface. Deploy rate-limiting rules on upstream network devices to throttle HTTP request volumes to the router's management IP (note: this may impact legitimate admin access during high-traffic periods). For critical deployments, replace the affected router with alternative hardware from vendors with active security support programs. Monitor the vendor security page at http://dbit.com and the GitHub disclosure repository at https://github.com/kirubel-cve/CVE-2026-36957 for potential firmware updates. As a last resort, schedule periodic router reboots during maintenance windows to clear resource exhaustion states, though this does not prevent exploitation and creates additional availability gaps.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today