EUVD-2026-26386Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
AnalysisAI
Cross-site request forgery in U-SPEED N300 Router V1.0.0 allows remote attackers to execute administrative actions through victim browsers when authenticated administrators visit attacker-controlled webpages. The router's web management interface lacks CSRF tokens and Origin/Referer validation, enabling attackers to craft malicious pages that trigger state-changing operations using the victim's valid session cookie. A proof-of-concept exploit exists (GitHub repository linked), though no active exploitation is confirmed in CISA KEV at time of analysis. CVSS 8.8 severity reflects high impact across confidentiality, integrity, and availability when exploitation succeeds.
Technical ContextAI
CSRF (CWE-352) exploits the web's stateless trust model where browsers automatically attach authentication credentials (cookies, Basic Auth headers) to cross-origin requests. The U-SPEED N300 Router V1.0.0 web management interface processes administrative API requests based solely on session cookie presence without validating request origin. Modern CSRF defenses include synchronizer tokens (unpredictable values embedded in forms and validated server-side), SameSite cookie attributes, or strict Origin/Referer header checks. The CPE data shows as not-applicable, indicating this may be an embedded/IoT device with limited vendor CVE infrastructure. The vulnerability affects state-changing endpoints that modify router configuration (wireless settings, firewall rules, admin credentials, firmware updates) but does not bypass authentication itself - it leverages existing authenticated sessions.
RemediationAI
No vendor-released patch or security advisory is identified in available references - only the vendor homepage (http://u-speed.com) and researcher disclosure (https://github.com/kirubel-cve/CVE-2026-36960) are linked. Users should immediately check the vendor website and router admin interface for firmware updates newer than V1.0.0. Until patching is confirmed available, implement these compensating controls: (1) Disable remote web management access and restrict admin interface to local LAN only via router firewall rules - eliminates most internet-based CSRF vectors but prevents legitimate remote administration; (2) Log out of the router admin interface immediately after configuration changes rather than leaving sessions open - reduces attack window but relies on user discipline; (3) Use a dedicated browser or browser profile for router administration with JavaScript disabled - breaks many modern admin interfaces but prevents malicious page execution; (4) Access router admin panel only from a hardened administrative workstation that does not browse general internet content - practical for enterprise but unrealistic for home users. These mitigations reduce but do not eliminate CSRF risk, as attacks can occur through malicious ads, compromised websites, or phishing emails opened while authenticated.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today