EUVD-2025-211035
GHSA-vgfm-pm37-pc7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin local Wi-Fi network
-
DeliveryAuthenticate to admin web interface
-
ExploitPOST oversized comment to /api/addStaticDHCP
-
ExecutionOverflow stack buffer in parser
-
ImpactExecute arbitrary OS commands on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) administrator authentication to the device's web management interface (PR:H) and (2) network reachability from the local Wi-Fi network - the request targets the authenticated /api/addStaticDHCP endpoint and overflows via the 'comment' parameter. These two factors - valid admin credentials plus on-network/Wi-Fi adjacency - are the primary limiting factors and sharply narrow realistic exploitability; there is no user-interaction requirement (UI:N) and complexity is low (AC:L), so once those preconditions are met the overflow triggers reliably. There is no remote-unauthenticated path. |
| Impact | This is a high-CVSS-but-low-real-world-priority issue once the signals are cross-referenced. The CVSS vector (AV:L/AC:L/PR:H/UI:N, C:H/I:H/A:H, base 6.7) explicitly requires PR:H - the attacker must already hold administrator credentials and be positioned on the local Wi-Fi network - so this is a post-authentication local privilege/command-execution flaw, not a remote pre-auth RCE. EPSS is low at 0.22% (12th percentile), consistent with the narrow preconditions, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. The klogixsecurity Scorpion Labs blog ('from hands-on to RCE') is a detailed research writeup that demonstrates exploitation, indicating a public proof-of-concept/exploit walkthrough exists - but POC availability is a distinct signal from active exploitation and should not be conflated. Net: a genuine memory-corruption RCE on the device, but gated behind admin authentication and Wi-Fi adjacency, so real-world priority is LOW-to-MODERATE. One discrepancy to verify: the NVD vector uses AV:L (local) while the description says the attack comes 'from the local Wi-Fi network,' which is more naturally Adjacent (AV:A) - verify reachability model with the source. |
| Exploit ScenarioDerived | An attacker who has gained administrator access to the Dbit WIFI4 N300 web interface (via default/weak credentials or credential theft) and is connected to the device's local Wi-Fi sends a crafted request to /api/addStaticDHCP with an overlong 'comment' field, overflowing a stack buffer and executing arbitrary OS commands on the router. A public exploitation writeup (Scorpion Labs/klogixsecurity) demonstrates the hands-on path to RCE. Because CVSS specifies AC:L, the overflow is reliably triggerable once the attacker is authenticated and on-network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
OS command execution on Dbit WIFI4 N300 1.0.0 routers is achievable by feeding an oversized 'comment' value to the authenticated /api/addStaticDHCP endpoint, which overflows a fixed-size stack buffer in the device's web management daemon and lets the caller pivot from web administrator to a shell on the underlying operating system. The practical barrier is high: the CVSS 3.1 vector (AV:A/PR:H per the independent assessment, versus the vendor-published AV:L/PR:H base of 6.7) means an attacker must already hold valid administrator credentials and be able to reach the device from the local Wi-Fi network - there is no unauthenticated remote path, and no user interaction is required once those preconditions are met. Exploitation status is low-signal: there is no CISA KEV listing and no confirmed in-the-wild activity, though a Klogix Security (Scorpion Labs) technical blog walks through the exploitation chain end-to-end, and EPSS is only 0.22% (12th percentile), underscoring that this is a high-CVSS-but-low-real-world-priority issue.
RemediationAI
No vendor-released patch was identified at time of analysis, so mitigation must be compensating. First, change the default administrator credentials and, if firmware allows it, disable or restrict the web management interface so that it is not reachable from the general Wi-Fi client VLAN - this directly removes the AV:A/PR:H precondition and is the single highest-value control, at the cost of losing convenient browser-based administration from wireless clients. Second, if static DHCP reservations are not operationally required, disable the /api/addStaticDHCP functionality or block POSTs to it at the network layer; on hardened deployments the same effect can be achieved by placing the router's management plane behind an authenticated reverse proxy or firewall rule that only permits a dedicated admin host, though this adds an operational dependency and single point of failure. Third, isolate IoT and guest traffic into a separate SSID/VLAN with client isolation enabled so that a compromised Wi-Fi client cannot reach the router's API, accepting that this may break local device-discovery features. Fourth, monitor router logs and any upstream IDS for unusually long 'comment' parameters or repeated POSTs to /api/addStaticDHCP, and reboot or reflash a device if a shell is suspected, since a successful overflow grants full control with no clean in-place recovery. Finally, track the Klogix Scorpion Labs write-up (https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux) and the VulDB entry (https://vuldb.com/vuln/414362) for an eventual firmware fix; given EPSS of 0.22% (12th percentile), no KEV listing, and confirmed in-the-wild exploitation absent, immediate emergency patching is not warranted, but the router should not be left on a Wi-Fi segment reachable by untrusted clients.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121, a classic stack-based buffer overflow (also tagged as a stack overflow in the supplied intelligence). Dbit WIFI4 N300 firmware 1.0.0 ships an embedded HTTP management daemon that exposes a JSON/form-style API surface, including /api/addStaticDHCP, which is used to register fixed IP reservations. The 'comment' field of that request is copied into a fixed-length stack buffer without length validation; supplying a value larger than the buffer overwrites saved registers and the return address, and because the underlying RTOS/Linux firmware build typically lacks stack canaries and full ASLR, the corrupted return path can be steered to execute arbitrary OS commands with the privileges of the web server process. The CPE supplied in the intelligence feed is unpopulated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and the ENISA EUVD entry likewise lists affected versions as 'n/a n/a', so the vendor/product identifiers are not yet registered in the standard CPE dictionary - affected versions must be determined from the firmware release itself (1.0.0) and from the vendor's own advisory channel. Note that the NVD vector records AV:L while the independent assessment records AV:A; the difference reflects whether the attacker interface is treated as the physical/logical host or as the adjacent Wi-Fi segment, and it does not change the high-privilege (PR:H) prerequisite either way.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Admin credentials required (PR:H) and attack originates on the local Wi-Fi/adjacent network (AV:A, differing from NVD's AV:L); authenticated overflow yields full device code execution (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB