What is the CVSS score of CVE-2026-36959?

CVE-2026-36959 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of U-SPEED N300 router are affected by CVE-2026-36959?

U-SPEED N300 router V1.0.0 contains an unauthenticated brute-force vulnerability on the administrative login endpoint that allows attackers on the local network to compromise router credentials…

How to fix or mitigate CVE-2026-36959?

Within 24 hours: Inventory all U-SPEED N300 V1.0.0 deployments and isolate affected devices from untrusted network segments; change all default and administrative credentials to complex passwords; disable remote management access if not required. Within 7 days: Implement network segmentation to restrict local network access to the router's management interface; deploy intrusion detection rules to alert on repeated failed authentication attempts to /api/login. Within 30 days: Contact U-SPEED for firmware updates or device replacement options; evaluate migration to alternative router models with active security support.

U-SPEED N300 router CVE-2026-36959

EUVD-2026-26380 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-04-30 mitre

Authentication Bypass N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 17:46 vuln.today

CVSS changed

Apr 30, 2026 - 16:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 30, 2026 - 15:00 euvd

EUVD-2026-26380

Analysis Generated

Apr 30, 2026 - 15:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.

AnalysisAI

Brute-force attacks against U-SPEED N300 router V1.0.0 can compromise administrator credentials due to missing rate limiting on the /api/login endpoint. Local network attackers can execute unlimited authentication attempts without account lockout, enabling credential compromise and unauthorized access to router management. SSVC indicates proof-of-concept exists and the attack is automatable with partial technical impact. CVSS 7.5 reflects network accessibility, but the vulnerability description specifies 'local network' access requirement, suggesting the actual attack vector may be more constrained than the AV:N metric indicates.

Technical ContextAI

This is a CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerability in the web management interface of the U-SPEED N300 router firmware V1.0.0. The /api/login REST API endpoint lacks fundamental authentication security controls: no rate limiting throttles request frequency, no account lockout occurs after failed attempts, and no CAPTCHA or similar challenge-response mechanism protects against automated credential stuffing. This implementation flaw is common in embedded device firmware where developers prioritize functionality over security hardening. The CPE string is incomplete (cpe:2.3:a:n/a:n/a), indicating the product is not yet formally catalogued in NVD's product database, which may reflect the vendor's limited security ecosystem maturity.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor website (http://u-speed.com) and researcher disclosure (https://github.com/kirubel-cve/CVE-2026-36959) do not reference a security update or fixed firmware version. Until a patch is available, implement network-layer compensating controls: isolate the router management interface to a dedicated VLAN accessible only from trusted administrator workstations, restricting access via firewall rules that permit only specific source IPs to reach the management interface. This reduces attack surface but requires network segmentation capability and does not protect against attacks from compromised trusted hosts. Alternatively, disable remote management entirely and configure the router only via direct physical console access, though this severely limits operational flexibility. Change default administrator credentials to strong passwords (16+ characters, high entropy) to increase brute-force time requirements from minutes to years, though this is defense-in-depth rather than a true fix given unlimited attempts. Deploy network intrusion detection systems to alert on excessive authentication failures from single source IPs as a detective control. Monitor the vendor website and researcher GitHub repository for patch announcements.