What is the CVSS score of CVE-2026-36957?

CVE-2026-36957 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dbit N300 T1 Pro are affected by CVE-2026-36957?

CVE-2026-36957 affects Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0, allowing unauthenticated remote attackers to completely disable network routing and management access by sending…

How to fix or mitigate CVE-2026-36957?

Within 24 hours: Identify all Dbit N300 T1 Pro Easy Setup routers (V1.0.0) on your network using asset inventory or network scanning; isolate affected devices to restricted networks if possible and document their locations. Within 7 days: Contact Dbit support to confirm patch availability timeline and interim firmware options; implement rate-limiting or network access controls on affected routers (restrict HTTP access to trusted administrative subnets only). Within 30 days: Establish a vendor communication protocol for patch release; evaluate alternative router vendors for devices requiring continuous availability; deploy replacement hardware if Dbit does not release a security update.

Dbit N300 T1 Pro CVE-2026-36957

EUVD-2026-26378 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-30 mitre

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 17:45 vuln.today

CVSS changed

Apr 30, 2026 - 16:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 15:00 euvd

EUVD-2026-26378

Analysis Generated

Apr 30, 2026 - 15:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. By initiating a high-volume flood of HTTP GET requests to non-existent URIs, an attacker can exhaust critical system resources, including file descriptors and memory buffers. This results in a kernel deadlock or system hang that disables the web management portal and all routing capabilities.

AnalysisAI

Remote attackers can crash Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 and disable all routing functionality by flooding the boa web server with HTTP GET requests to non-existent URIs. The attack exhausts file descriptors and memory buffers, causing kernel deadlock that kills both the web management interface and core routing services. SSVC framework confirms proof-of-concept exploit exists and the attack is fully automatable against default router configurations with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N).

Technical ContextAI

The vulnerability resides in the boa web server, a lightweight HTTP daemon commonly embedded in consumer networking devices. Boa's URI handler in this firmware version (V1.0.0) lacks proper resource limits when processing requests to non-existent paths. The CWE-400 (Uncontrolled Resource Consumption) flaw allows unbounded allocation of file descriptors and memory buffers during error handling for 404 responses. Because boa runs with kernel-level privileges in typical embedded router architectures, resource exhaustion cascades into kernel space, triggering a deadlock condition rather than graceful degradation. The CPE string is generic (cpe:2.3:a:n/a:n/a), indicating limited vendor participation in NVD cataloging, but the specific affected product is the Dbit N300 T1 Pro wireless router running firmware V1.0.0.

RemediationAI

No vendor-released firmware patch has been identified at the time of analysis. Users should implement immediate compensating controls: Disable external access to the web management interface (typically TCP port 80/443) via router firewall rules, restricting admin access to trusted internal IP ranges only. Configure upstream network firewall or ISP router to block inbound HTTP/HTTPS traffic to the Dbit router's WAN interface. Deploy rate-limiting rules on upstream network devices to throttle HTTP request volumes to the router's management IP (note: this may impact legitimate admin access during high-traffic periods). For critical deployments, replace the affected router with alternative hardware from vendors with active security support programs. Monitor the vendor security page at http://dbit.com and the GitHub disclosure repository at https://github.com/kirubel-cve/CVE-2026-36957 for potential firmware updates. As a last resort, schedule periodic router reboots during maintenance windows to clear resource exhaustion states, though this does not prevent exploitation and creates additional availability gaps.