Dbit T-CPE301K CVE-2026-7192

Requires network reachability to the T-CPE301K web management interface and, per the description, an authenticated session; the attacker then sends an HTTP POST to the specific endpoint /js/common/do_cmd.js with an excessively long parameter. Exploitation is limited by the authentication requirement (contradicting the PR:N in the scored vector) and by the device's small deployment footprint; the confirmed outcome is DoS/reboot, with arbitrary code execution only a theoretical possibility implied by PC/RA register overwrite.

The vendor/INCIBE-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3 Critical) rates this as a remote, unauthenticated, full-CIA-impact flaw, but two internal contradictions weaken that headline number. First, the description explicitly says an 'authenticated attacker' is required, which conflicts with the PR:N (no privileges) in the scored vector - these cannot both be true, so the true privilege requirement should be treated as PR:L pending vendor confirmation. Second, the described real-world impact is limited to denial of service and a system reboot (an availability event), which does not match the VC:H/VI:H (full confidentiality and integrity) claimed in the vector; the VC:H/VI:H appears to be an inference from the fact that the overflow overwrites the PC and RA registers (a classic precursor to arbitrary code execution), but no code execution is actually demonstrated or claimed. There is no EPSS score, no CISA KEV listing, and no public POC referenced - only an INCIBE advisory with a vendor patch. Net assessment: this is a genuine, patchable stack overflow in a network-facing router web endpoint, but the effective risk is a post-authentication DoS/reboot rather than the unauthenticated RCE the 9.3 implies. Combined with a small real-world deployment footprint, this is lower real priority than the Critical rating suggests, though the register-overwrite behavior means an RCE upgrade cannot be fully ruled out.

An attacker who has authenticated to the T-CPE301K router's web management interface sends a crafted HTTP POST to /js/common/do_cmd.js containing an over-length parameter, overflowing a stack buffer and overwriting the PC and RA registers. This crashes the responsible service and forces a device reboot, dropping the router's connectivity; no public exploit code is currently referenced, though the register overwrite hints at potential for further exploitation.