Dbit T-CPE301K EUVD-2026-88757

Requires network adjacency - the attacker must already be connected to the same local network (WiFi or LAN) as the T-CPE301K router, and the Telnet service on port 23 must be reachable and enabled (the default per the description). No authentication challenge is meaningfully imposed because the credentials are predefined/static and shared across devices; knowledge of the fixed credential is the only prerequisite. Exploitation is limited to adjacent-network attackers rather than fully remote internet-based ones, which constrains realistic risk to guests, other WiFi clients, or an attacker on a compromised local segment.

The vendor CVSS 4.0 score of 8.6 (High) reflects total compromise - full root access with complete confidentiality, integrity, and availability loss (VC:H/VI:H/VA:H) via static Telnet credentials. However, the scoring signals conflict with the description and warrant scrutiny. The vendor vector uses AV:N (network) and PR:H (high privileges required), but the description states the attacker must be 'connected to the same network' and merely uses static/predefined credentials - which implies adjacent-network access (AV:A) and NO legitimate privilege (PR:N), since the whole point of hardcoded credentials is that no prior authorization is needed. The PR:H metric is almost certainly wrong for a CWE-798 hardcoded-credential flaw; anyone who knows the static credential can log in. There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so this is not confirmed to be under active exploitation. That said, hardcoded-credential Telnet backdoors in consumer routers are trivially exploitable once the credential is published and are historically attractive to IoT botnets. Real-world priority is bounded mainly by the product's narrow deployment footprint and the adjacent-network requirement, not by exploit difficulty.

An attacker who has joined the router's WiFi or local LAN opens a Telnet session to port 23 and logs in with the device's built-in static credentials, obtaining a root shell with no further exploitation required. No public exploit code was identified in the provided data, but the attack requires only a Telnet client and knowledge of the fixed credential.