EUVD-2026-26377Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
AnalysisAI
Cross-site request forgery in Dbit N300 T1 Pro wireless router V1.0.0 allows remote unauthenticated attackers to execute arbitrary administrative actions by convincing an authenticated administrator to visit a malicious webpage. The router lacks anti-CSRF tokens and Origin/Referer validation on configuration endpoints like /api/setWlan, enabling complete router compromise through social engineering. Publicly available exploit code exists (SSVC: poc status) with EPSS data not provided, indicating proof-of-concept demonstration but no confirmed active exploitation at time of analysis.
Technical ContextAI
CSRF (CWE-352) is a session-riding attack exploiting the automatic credential inclusion behavior of web browsers. When a user authenticates to a web application, the browser stores session cookies and automatically attaches them to all subsequent requests to that domain. Without anti-CSRF tokens (unpredictable values tied to the user session) or strict Origin/Referer header validation, the application cannot distinguish legitimate user-initiated requests from attacker-crafted requests loaded via malicious websites. The Dbit N300 T1 Pro router's web management interface at endpoints like /api/setWlan accepts state-changing administrative commands based solely on valid session cookies, with no secondary validation mechanism. This is a classic implementation flaw in embedded device web interfaces that rely exclusively on cookie-based authentication without implementing the synchronizer token pattern or SameSite cookie attributes. The CPE data provided (cpe:2.3:a:n/a:n/a) is malformed and does not identify the specific Dbit product, indicating incomplete vulnerability cataloging.
RemediationAI
No vendor-released patch identified at time of analysis - neither the Dbit vendor reference (http://dbit.com) nor the GitHub POC repository (https://github.com/kirubel-cve/CVE-2026-36956) provide fix versions or official advisories. Until a patched firmware becomes available, implement network-level compensating controls: restrict web management interface access to dedicated admin VLANs or trusted source IPs only using firewall rules or the router's built-in access control lists, blocking external network access to the management interface entirely. Configure browsers used for router administration with strict SameSite cookie policies if supported, or use isolated browser profiles/VMs exclusively for infrastructure management that never visit untrusted websites. Reduce session timeout values to minimize the exploitation window (trade-off: increased admin re-authentication). Deploy web proxy or DNS filtering to block known malicious domains for administrative workstations. These mitigations significantly reduce attack surface but do not eliminate the underlying vulnerability - administrators must maintain strict browsing hygiene during active management sessions until vendor patches are released.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today